.. # ******************************************************************************* # Copyright (c) 2026 Contributors to the Eclipse Foundation # # See the NOTICE file(s) distributed with this work for additional # information regarding copyright ownership. # # This program and the accompanying materials are made available under the # terms of the Apache License Version 2.0 which is available at # https://www.apache.org/licenses/LICENSE-2.0 # # SPDX-License-Identifier: Apache-2.0 # ******************************************************************************* mw_com_fmea =========== Overview -------- .. list-table:: :header-rows: 1 * - Failure Mode - Guideword - ASIL - Interface * - :ref:`AnyFunctionBlocksLongerThanExpected ` - - B - * - :ref:`InMemoryConfigurationWrong ` - - B - mw.com.Runtime.Initialize * - :ref:`FunctionCalledFromMultipleThreads ` - - B - * - :ref:`GeneratedCodeDoesNotMatchGenerationInputs ` - - B - * - :ref:`MisusedApis ` - - B - * - :ref:`CreationOfSkeletonNotPossible ` - - B - mw.com.Skeleton.Create * - :ref:`ServiceOfferedWithoutInitialFieldValue ` - - B - mw.com.Skeleton.OfferService * - :ref:`ServiceNotOffered ` - - B - mw.com.Skeleton.OfferService * - :ref:`ServiceOfferedOnWrongBinding ` - - B - mw.com.Skeleton.OfferService * - :ref:`ServiceOfferedUnderWrongIds ` - - B - mw.com.Skeleton.OfferService * - :ref:`OffersAlreadyOfferedService ` - - B - mw.com.Skeleton.OfferService * - :ref:`ServiceOnlyPartiallyOffered ` - - B - mw.com.Skeleton.OfferService * - :ref:`ServiceOfferingNotStopped ` - - B - * - :ref:`ServiceOnlyPartiallyStopOffered ` - - B - mw.com.Skeleton.StopOfferService * - :ref:`ServiceStopOfferedOnWrongBinding ` - - B - * - :ref:`ServiceStopOfferingWrongIds ` - - B - mw.com.Skeleton.StopOfferService * - :ref:`MemoryAllocatedInWrongSection ` - - B - * - :ref:`TooFewMemoryAllocated ` - - B - mw.com.Event.Allocate * - :ref:`WronglyAlignedMemoryAllocated ` - - B - * - :ref:`TooMuchMemoryAllocated ` - - B - * - :ref:`AllocatesAlreadyAllocatedMemory ` - - B - * - :ref:`SendingEventChangesUserData ` - - B - mw.com.Event.Send * - :ref:`SendingAnEventOrFieldSendsDataOnlyPartially ` - - B - * - :ref:`SendingEventOnlyPartiallyNotifiesConsumer ` - - B - mw.com.Event.Send * - :ref:`SendingEventSendsToWrongConsumer ` - - B - mw.com.Event.Send * - :ref:`SendingAnEventOrFieldSendsSameSampleNtimes ` - - B - * - :ref:`SendingEventDoesNotFreeResources ` - - B - mw.com.Event.Send * - :ref:`WrongResourcesFreed ` - - B - mw.com.Skeleton.Destroy * - :ref:`NoResourcesFreed ` - - B - mw.com.Skeleton.Destroy * - :ref:`EarlyCleanUp ` - - B - * - :ref:`WrongMethodInArgsUsed ` - - B - * - :ref:`WrongMethodCalled ` - - B - * - :ref:`WrongResultsProvided ` - - B - * - :ref:`StartFindServiceCallbackCalledUnexpectedly ` - - B - mw.com.Proxy.StartFindService * - :ref:`ServiceNotFound ` - - B - mw.com.Proxy.FindService * - :ref:`WrongServiceFound ` - - B - mw.com.Proxy.FindService * - :ref:`ServiceIsFoundButDoesNotExist ` - - B - mw.com.Proxy.FindService * - :ref:`StartedFindServiceIsNotStopped ` - - B - * - :ref:`WrongStartfindserviceIsStopped ` - - B - * - :ref:`SubscribeToWrongEvent ` - - B - * - :ref:`SubscribeWithWrongMaxSampleCount ` - - B - * - :ref:`DoesNotSubscribe ` - - B - * - :ref:`ReceiveHandlerNotInvoked ` - - B - * - :ref:`ReceiveHandlerInvokedWithWrongEvent ` - - B - * - :ref:`ReceiveHandlerInvokedMultipleTimes ` - - B - * - :ref:`ReceiveHandlerInvokedWithoutEventNotification ` - - B - * - :ref:`CallbackNotInvokedDespiteSamplesAvailable ` - - B - * - :ref:`CallbackInvokedWithWrongData ` - - B - * - :ref:`UsesToManySampleptr ` - - B - * - :ref:`ReturnsWrongSampleCount ` - - B - * - :ref:`SucceedsDespiteAnError ` - - B - mw.com.Event.GetNewSamples * - :ref:`ReturnsWrongFreeSampleCount ` - - B - * - :ref:`DoesNotUnsubscribe ` - - B - * - :ref:`UnsubscribesFromWrongEvent ` - - B - * - :ref:`DoesNotImplicitRemoveReceiveHandler ` - - B - * - :ref:`MapContainingNonexistentEvents ` - - B - * - :ref:`IncompleteMapOfEvents ` - - B - * - :ref:`TheSizeReturnedIsBiggerThenTheActualValue ` - - B - mw.com.GenericProxyEvent.GetSampleSize * - :ref:`TheSizeReturnedIsSmallerThenTheActualSize ` - - B - mw.com.GenericProxyEvent.GetSampleSize * - :ref:`WrongIndicationIfFormatIsSerialized ` - - B - mw.com.GenericProxyEvent.HasSerializedFormat * - :ref:`MethodCallBlocksLongerThanExpected ` - - B - * - :ref:`WrongMethodInArgsProvided ` - - B - * - :ref:`WrongReturnValueUsed ` - - B - * - :ref:`DoesNotFreeResourcesOnDestruction ` - - B - * - :ref:`FreesWrongResources ` - - B - * - :ref:`DoesNotReserveResources ` - - B - * - :ref:`DoesNotUpdateFreeSampleCountCorrectly ` - - B - * - :ref:`ReturnsWrongData ` - - B - * - :ref:`MethodSignatureElementPtrWrongTarget ` - - B - * - :ref:`MethodSignatureElementPtrFailsToFree ` - - B - Failure Modes ------------- .. dropdown:: Communication.InMemoryConfigurationWrong :name: fmea-communication-inmemoryconfigurationwrong .. grid:: 2 :gutter: 3 .. grid-item:: :class: sd-text-center :bdg-warning:`ASIL B` .. grid-item-card:: Interface mw.com.Runtime.Initialize .. grid-item-card:: Failure Effect Other functionality relies on a correct configuration. Without that, multiple functions can not operate normally which could lead to the violation of a safety goal. .. grid:: 1 .. grid-item-card:: Description The in-memory (cpp representation) does not match the on file-system JSON configuration. .. rubric:: Root Cause Analysis .. uml:: in_memory_configuration_wrong_fta.puml .. dropdown:: Communication.MethodCallBlocksLongerThanExpected :name: fmea-communication-methodcallblockslongerthanexpected .. grid:: 2 :gutter: 3 .. grid-item:: :class: sd-text-center :bdg-warning:`ASIL B` .. grid-item-card:: Failure Effect This could cause a halt of parts of/or the whole system. .. grid:: 1 .. grid-item-card:: Description A call to a service-method on the client/consumer side blocks longer than expected (or indefinite). This is a specific instance of FailureMode [AnyFunctionBlocksLongerThanExpected], but since with service-methods we have concrete root causes in the form of message-passing behaviour and behaviour of user-provided handler, we have this specific failure mode. .. rubric:: Root Cause Analysis .. uml:: call_blocks_fta.puml .. dropdown:: Communication.WrongMethodInArgsProvided :name: fmea-communication-wrongmethodinargsprovided .. grid:: 2 :gutter: 3 .. grid-item:: :class: sd-text-center :bdg-warning:`ASIL B` .. grid-item-card:: Failure Effect Communication of data-garbage, which could harm an overall safety goal. .. grid:: 1 .. grid-item-card:: Description Unintended input arguments are provided to a service method call. Therefore, the method call gets executed with wrong input data. .. rubric:: Root Cause Analysis .. uml:: wrong_in_args_provided_fta.puml .. dropdown:: Communication.WrongReturnValueUsed :name: fmea-communication-wrongreturnvalueused .. grid:: 2 :gutter: 3 .. grid-item:: :class: sd-text-center :bdg-warning:`ASIL B` .. grid-item-card:: Failure Effect Communication of data-garbage, which could harm an overall safety goal. .. grid:: 1 .. grid-item-card:: Description Unintended results are provided from a service method call. Therefore, the caller of the method works on wrong data. .. rubric:: Root Cause Analysis .. uml:: wrong_results_used_fta.puml .. dropdown:: Communication.ServiceIsFoundButDoesNotExist :name: fmea-communication-serviceisfoundbutdoesnotexist .. grid:: 2 :gutter: 3 .. grid-item:: :class: sd-text-center :bdg-warning:`ASIL B` .. grid-item-card:: Interface mw.com.Proxy.FindService .. grid-item-card:: Failure Effect No communication between process will happen, thus no information can be exchanged, thus any overall system functionality can stop. .. grid:: 1 .. grid-item-card:: Description Finding a service, returns a service, even though no service instance was offered. .. rubric:: Root Cause Analysis .. uml:: service_is_found_but_does_not_exist_fta.puml .. dropdown:: Communication.ServiceNotFound :name: fmea-communication-servicenotfound .. grid:: 2 :gutter: 3 .. grid-item:: :class: sd-text-center :bdg-warning:`ASIL B` .. grid-item-card:: Interface mw.com.Proxy.FindService .. grid-item-card:: Failure Effect No communication between process will happen, thus no information can be exchanged, thus any overall system functionality can stop. .. grid:: 1 .. grid-item-card:: Description A proxy does not find a service instance, even though it was offered by a skeleton. .. rubric:: Root Cause Analysis .. uml:: service_not_found_fta.puml .. dropdown:: Communication.WrongServiceFound :name: fmea-communication-wrongservicefound .. grid:: 2 :gutter: 3 .. grid-item:: :class: sd-text-center :bdg-warning:`ASIL B` .. grid-item-card:: Interface mw.com.Proxy.FindService .. grid-item-card:: Failure Effect The actual intended communication will not happen, thus potential causing a complete loss of system functionality. In the worst case, the wrong identifiers are used by another service. In that case a wrong consumer could think that he found the right service, leading to a case where garbage data is transmitted, causing any potential issues in the whole system functionality (e.g. violating the top level safety goal). .. grid:: 1 .. grid-item-card:: Description A proxy instance finds a wrong service. This could be either a wrong service instance or a completely wrong service. .. rubric:: Root Cause Analysis .. uml:: wrong_service_found_fta.puml .. dropdown:: Communication.TheSizeReturnedIsBiggerThenTheActualValue :name: fmea-communication-thesizereturnedisbiggerthentheactualvalue .. grid:: 2 :gutter: 3 .. grid-item:: :class: sd-text-center :bdg-warning:`ASIL B` .. grid-item-card:: Interface mw.com.GenericProxyEvent.GetSampleSize .. grid-item-card:: Failure Effect Undefined behavior due to wrong memory access. .. grid:: 1 .. grid-item-card:: Description The user receives a size, that is bigger then the actual value. .. rubric:: Root Cause Analysis .. uml:: the_size_returned_is_bigger_then_actual_value_fta.puml .. dropdown:: Communication.MapContainingNonexistentEvents :name: fmea-communication-mapcontainingnonexistentevents .. grid:: 2 :gutter: 3 .. grid-item:: :class: sd-text-center :bdg-warning:`ASIL B` .. grid-item-card:: Failure Effect A user could take wrong actions based on this information and thus affect any safety goal. .. grid:: 1 .. grid-item-card:: Description The map that is visible to the user, contains events that are not actually existing (e.g. in the configuration). .. rubric:: Root Cause Analysis .. uml:: map_containing_nonexistent_events_fta.puml .. dropdown:: Communication.CallbackInvokedWithWrongData :name: fmea-communication-callbackinvokedwithwrongdata .. grid:: 2 :gutter: 3 .. grid-item:: :class: sd-text-center :bdg-warning:`ASIL B` .. grid-item-card:: Failure Effect processing of invalid data can cause any safety violation (e.g. violation of the top level safety goal) .. grid:: 1 .. grid-item-card:: Description A proxy receives a sample pointer via callback F(), but the data does not contain the expected one. .. rubric:: Root Cause Analysis .. uml:: callback_invoked_with_wrong_data_fta.puml .. dropdown:: Communication.CallbackNotInvokedDespiteSamplesAvailable :name: fmea-communication-callbacknotinvokeddespitesamplesavailable .. grid:: 2 :gutter: 3 .. grid-item:: :class: sd-text-center :bdg-warning:`ASIL B` .. grid-item-card:: Failure Effect data is not received, causing any possible safety goal violation. .. grid:: 1 .. grid-item-card:: Description GetNewSamples() gets called on an event with a callback F, but the callback gets called not at all, although at least one new sample is available. .. rubric:: Root Cause Analysis .. uml:: callback_not_invoked_despite_samples_available_fta.puml .. dropdown:: Communication.StartFindServiceCallbackCalledUnexpectedly :name: fmea-communication-startfindservicecallbackcalledunexpectedly .. grid:: 2 :gutter: 3 .. grid-item:: :class: sd-text-center :bdg-warning:`ASIL B` .. grid-item-card:: Interface mw.com.Proxy.StartFindService .. grid-item-card:: Failure Effect In the worst case, the callback is invoked all the time, which could lead to: The user thinks that a new proxy is found and creates a proxy with an already used handle; A DDoS is performed, where one thread is constantly blocked. Both can lead to violations of safety goals. .. grid:: 1 .. grid-item-card:: Description The user-provided callback is invoked, even though it should not be invoked. .. rubric:: Root Cause Analysis .. uml:: start_find_service_callback_is_redundantly_called_fta.puml .. dropdown:: Communication.SubscribeToWrongEvent :name: fmea-communication-subscribetowrongevent .. grid:: 2 :gutter: 3 .. grid-item:: :class: sd-text-center :bdg-warning:`ASIL B` .. grid-item-card:: Failure Effect It is possible to allocate resources on another event and therefor block another valid subscription to this event. This could cause in the worst case that an safety relevant event cannot receive data, thus harming overall safety goals. Another case is that garbage data is transmitted / received. Causing any possible side-effect. .. grid:: 1 .. grid-item-card:: Description A service proxy subscribes to a wrong event. This either means that this event does not exist at all, is offered by another service instance, another event in the current instance or a completely different service. .. rubric:: Root Cause Analysis .. uml:: subscribe_to_wrong_event_fta.puml .. dropdown:: Communication.SubscribeWithWrongMaxSampleCount :name: fmea-communication-subscribewithwrongmaxsamplecount .. grid:: 2 :gutter: 3 .. grid-item:: :class: sd-text-center :bdg-warning:`ASIL B` .. grid-item-card:: Failure Effect We have two possible effects: First if the number is lower then expected data of the user might be lost unexpectedly. Causing any possible side-effects. If its bigger, we could blocker other receiver which then get to few resources. Or the subscription fails at all. In the first two cases a possible safety goal violation could happen by not transmitting safety relevant data reliably. .. grid:: 1 .. grid-item-card:: Description A proxy instance subscribes to an event to with a wrong sample count, meaning a different one that was provided by the user. .. rubric:: Root Cause Analysis .. uml:: subscribe_with_wrong_max_sample_count_fta.puml .. dropdown:: Communication.DoesNotUnsubscribe :name: fmea-communication-doesnotunsubscribe .. grid:: 2 :gutter: 3 .. grid-item:: :class: sd-text-center :bdg-warning:`ASIL B` .. grid-item-card:: Failure Effect Resource blockage on new subscriptions on other consumers. Maybe no communication possible. .. grid:: 1 .. grid-item-card:: Description A proxy is subscribed to an event, tries to unsubscribe, but silently fails to unsubscribe. .. rubric:: Root Cause Analysis .. uml:: does_not_unsubscribe_fta.puml .. dropdown:: Communication.MemoryAllocatedInWrongSection :name: fmea-communication-memoryallocatedinwrongsection .. grid:: 2 :gutter: 3 .. grid-item:: :class: sd-text-center :bdg-warning:`ASIL B` .. grid-item-card:: Failure Effect This could cause transmitting garbage data between processes, causing a complete outage of the system. In the worst case the safety goal could be violated. .. grid:: 1 .. grid-item-card:: Description The memory for an event is allocated in the wrong memory section (e.g. in Heap, another Shared Memory segment or the stack). .. rubric:: Root Cause Analysis .. uml:: allocate_in_wrong_memory_fta.puml .. dropdown:: Communication.TooFewMemoryAllocated :name: fmea-communication-toofewmemoryallocated .. grid:: 2 :gutter: 3 .. grid-item:: :class: sd-text-center :bdg-warning:`ASIL B` .. grid-item-card:: Interface mw.com.Event.Allocate .. grid-item-card:: Failure Effect This could cause transmitting garbage data between processes, causing a complete outage of the system. In the worst case the safety goal could be violated. .. grid:: 1 .. grid-item-card:: Description The event allocation allocates too few memory (including no memory at all). .. rubric:: Root Cause Analysis .. uml:: to_few_memory_allocated_fta.puml .. dropdown:: Communication.CreationOfSkeletonNotPossible :name: fmea-communication-creationofskeletonnotpossible .. grid:: 2 :gutter: 3 .. grid-item:: :class: sd-text-center :bdg-warning:`ASIL B` .. grid-item-card:: Interface mw.com.Skeleton.Create .. grid-item-card:: Failure Effect No communication possible. .. grid:: 1 .. grid-item-card:: Description It is not possible to create a skeleton instance .. rubric:: Root Cause Analysis .. uml:: creation_of_skeleton_not_possible_fta.puml .. dropdown:: Communication.NoResourcesFreed :name: fmea-communication-noresourcesfreed .. grid:: 2 :gutter: 3 .. grid-item:: :class: sd-text-center :bdg-warning:`ASIL B` .. grid-item-card:: Interface mw.com.Skeleton.Destroy .. grid-item-card:: Failure Effect Can cause an overall resource exhaustion. .. grid:: 1 .. grid-item-card:: Description The resources allocated on construction and during operation are not freed on destruction. .. rubric:: Root Cause Analysis .. uml:: no_resources_freed_fta.puml .. dropdown:: Communication.WrongResourcesFreed :name: fmea-communication-wrongresourcesfreed .. grid:: 2 :gutter: 3 .. grid-item:: :class: sd-text-center :bdg-warning:`ASIL B` .. grid-item-card:: Interface mw.com.Skeleton.Destroy .. grid-item-card:: Failure Effect This could cause transmitting garbage data between processes, causing a complete outage of the system. In the worst case the safety goal could be violated. .. grid:: 1 .. grid-item-card:: Description A destruction of one skeleton instances, frees the resources of another skeleton instance. .. rubric:: Root Cause Analysis .. uml:: wrong_resources_freed_fta.puml .. dropdown:: Communication.WrongMethodInArgsUsed :name: fmea-communication-wrongmethodinargsused .. grid:: 2 :gutter: 3 .. grid-item:: :class: sd-text-center :bdg-warning:`ASIL B` .. grid-item-card:: Failure Effect Communication of data-garbage, which could harm an overall safety goal. .. grid:: 1 .. grid-item-card:: Description Unintended input arguments are used in a service method call. Therefore, the method call gets executed with wrong input data. .. rubric:: Root Cause Analysis .. uml:: wrong_in_args_used_fta.puml .. dropdown:: Communication.WrongMethodCalled :name: fmea-communication-wrongmethodcalled .. grid:: 2 :gutter: 3 .. grid-item:: :class: sd-text-center :bdg-warning:`ASIL B` .. grid-item-card:: Failure Effect Communication of data-garbage, which could harm an overall safety goal. .. grid:: 1 .. grid-item-card:: Description Either the wrong user provided method handler is called or no user handler is called at all. Therefore, the method call results are invalid/garbage. .. rubric:: Root Cause Analysis .. uml:: wrong_method_called_fta.puml .. dropdown:: Communication.WrongResultsProvided :name: fmea-communication-wrongresultsprovided .. grid:: 2 :gutter: 3 .. grid-item:: :class: sd-text-center :bdg-warning:`ASIL B` .. grid-item-card:: Failure Effect Communication of data-garbage, which could harm an overall safety goal. .. grid:: 1 .. grid-item-card:: Description The result of a method call is either not provided in the expected location, leaving uninitialized data in the expected location or it is provided in an inconsistent state. Therefore, the method call results are invalid/garbage. .. rubric:: Root Cause Analysis .. uml:: wrong_results_provided_fta.puml .. dropdown:: Communication.OffersAlreadyOfferedService :name: fmea-communication-offersalreadyofferedservice .. grid:: 2 :gutter: 3 .. grid-item:: :class: sd-text-center :bdg-warning:`ASIL B` .. grid-item-card:: Interface mw.com.Skeleton.OfferService .. grid-item-card:: Failure Effect Already existing communication could break up. Or data could be overwritten while transmitted. In any case this could cause potential garbage data, which could cause a complete malfunction of the system. .. grid:: 1 .. grid-item-card:: Description A skeleton offers a service that was already offered. Either by another process or by itself. .. rubric:: Root Cause Analysis .. uml:: offers_already_offered_service_fta.puml .. dropdown:: Communication.ServiceOnlyPartiallyOffered :name: fmea-communication-serviceonlypartiallyoffered .. grid:: 2 :gutter: 3 .. grid-item:: :class: sd-text-center :bdg-warning:`ASIL B` .. grid-item-card:: Interface mw.com.Skeleton.OfferService .. grid-item-card:: Failure Effect This is equal to the case service not offered, thus no information can be exchanged, thus any overall system functionality can stop. .. grid:: 1 .. grid-item-card:: Description A skeleton offers a service, which is not visible to all consumers, but only to parts of them. .. rubric:: Root Cause Analysis .. uml:: only_partially_offered_fta.puml .. dropdown:: Communication.ServiceOfferedUnderWrongIds :name: fmea-communication-serviceofferedunderwrongids .. grid:: 2 :gutter: 3 .. grid-item:: :class: sd-text-center :bdg-warning:`ASIL B` .. grid-item-card:: Interface mw.com.Skeleton.OfferService .. grid-item-card:: Failure Effect The actual intended communication will not happen, thus potential causing a complete loss of system functionality. In the worst case, the wrong identifiers are used by another service. In that case a wrong consumer could think that he found the right service, leading to a case where garbage data is transmitted, causing any potential issues in the whole system functionality (e.g. violating the top level safety goal). .. grid:: 1 .. grid-item-card:: Description A skeleton is offering a service with wrong identifiers. This can include a service id, a instance id or also the service version. .. rubric:: Root Cause Analysis .. uml:: service_offered_under_wrong_id_fta.puml .. dropdown:: Communication.ServiceNotOffered :name: fmea-communication-servicenotoffered .. grid:: 2 :gutter: 3 .. grid-item:: :class: sd-text-center :bdg-warning:`ASIL B` .. grid-item-card:: Interface mw.com.Skeleton.OfferService .. grid-item-card:: Failure Effect No communication between process will happen, thus no information can be exchanged, thus any overall system functionality can stop. .. grid:: 1 .. grid-item-card:: Description A skeleton service is offering a service, but the service is silently not offered. Note: offered in this case means, that it is also connectable .. rubric:: Root Cause Analysis .. uml:: skeleton_not_offered_fta.puml .. dropdown:: Communication.ServiceOfferedWithoutInitialFieldValue :name: fmea-communication-serviceofferedwithoutinitialfieldvalue .. grid:: 2 :gutter: 3 .. grid-item:: :class: sd-text-center :bdg-warning:`ASIL B` .. grid-item-card:: Interface mw.com.Skeleton.OfferService .. grid-item-card:: Failure Effect A user expects after seeing a service offered, in a call to GetNewSamples(), that he would at least get one new sample. This could hinder the expected semantics on user side, and thus affect any safety goal. .. grid:: 1 .. grid-item-card:: Description A service is offered, although at least one of its field has no initial value set by the provider. .. rubric:: Root Cause Analysis .. uml:: skeleton_not_offered_without_initial_fieled_value_fta.puml .. dropdown:: Communication.ServiceOfferedOnWrongBinding :name: fmea-communication-serviceofferedonwrongbinding .. grid:: 2 :gutter: 3 .. grid-item:: :class: sd-text-center :bdg-warning:`ASIL B` .. grid-item-card:: Interface mw.com.Skeleton.OfferService .. grid-item-card:: Failure Effect No communication between processes will happen, thus, no information can be exchanged, thus, any overall system functionality can malfunction. The point that a service is offered on another binding should not have any effect, since no consumer will expect the service on this binding. .. grid:: 1 .. grid-item-card:: Description A skeleton is offering a service on the wrong binding. Meaning, the service is not offered on the intended binding, but on an unintended one. .. rubric:: Root Cause Analysis .. uml:: skeleton_offered_wrong_binding_fta.puml .. dropdown:: Communication.SendingEventChangesUserData :name: fmea-communication-sendingeventchangesuserdata .. grid:: 2 :gutter: 3 .. grid-item:: :class: sd-text-center :bdg-warning:`ASIL B` .. grid-item-card:: Interface mw.com.Event.Send .. grid-item-card:: Failure Effect This could cause transmitting garbage data between processes, causing a complete outage of the system. In the worst case the safety goal could be violated. .. grid:: 1 .. grid-item-card:: Description A call to send manipulates the data that was provided by the caller. .. rubric:: Root Cause Analysis .. uml:: changes_user_data_fta.puml .. dropdown:: Communication.SendingEventDoesNotFreeResources :name: fmea-communication-sendingeventdoesnotfreeresources .. grid:: 2 :gutter: 3 .. grid-item:: :class: sd-text-center :bdg-warning:`ASIL B` .. grid-item-card:: Interface mw.com.Event.Send .. grid-item-card:: Failure Effect This could lead to a resource exhaustion of the system. Leading to a situation where no communication would be possible. .. grid:: 1 .. grid-item-card:: Description Resources in the middleware that have been allocated with a previous allocation, are not freed after returning from send/update. .. rubric:: Root Cause Analysis .. uml:: does_not_free_resources_after_usage_fta.puml .. dropdown:: Communication.SendingEventOnlyPartiallyNotifiesConsumer :name: fmea-communication-sendingeventonlypartiallynotifiesconsumer .. grid:: 2 :gutter: 3 .. grid-item:: :class: sd-text-center :bdg-warning:`ASIL B` .. grid-item-card:: Interface mw.com.Event.Send .. grid-item-card:: Failure Effect This could cause that data is not processed, causing a complete outage of the system. In the worst case the safety goal could be violated. .. grid:: 1 .. grid-item-card:: Description When data is sent, consumers that have a callback registered, are only partially notified. .. rubric:: Root Cause Analysis .. uml:: only_partially_notifies_user_fta.puml .. dropdown:: Communication.SendingEventSendsToWrongConsumer :name: fmea-communication-sendingeventsendstowrongconsumer .. grid:: 2 :gutter: 3 .. grid-item:: :class: sd-text-center :bdg-warning:`ASIL B` .. grid-item-card:: Interface mw.com.Event.Send .. grid-item-card:: Failure Effect This could cause transmitting garbage data between processes, causing a complete outage of the system. In the worst case the safety goal could be violated. .. grid:: 1 .. grid-item-card:: Description An event or field is sent to the wrong consumer. .. rubric:: Root Cause Analysis .. uml:: sends_to_wrong_consumer_fta.puml .. dropdown:: Communication.ServiceOnlyPartiallyStopOffered :name: fmea-communication-serviceonlypartiallystopoffered .. grid:: 2 :gutter: 3 .. grid-item:: :class: sd-text-center :bdg-warning:`ASIL B` .. grid-item-card:: Interface mw.com.Skeleton.StopOfferService .. grid-item-card:: Failure Effect A service is found by a consumer, even though it shall no longer be found. This shall have no bad influence, since then no data will be send. .. grid:: 1 .. grid-item-card:: Description A skeleton stop offers a service, but the service is still seen a partial set of consumers. .. rubric:: Root Cause Analysis .. uml:: only_partially_stop_offer_fta.puml .. dropdown:: Communication.ServiceStopOfferingWrongIds :name: fmea-communication-servicestopofferingwrongids .. grid:: 2 :gutter: 3 .. grid-item:: :class: sd-text-center :bdg-warning:`ASIL B` .. grid-item-card:: Interface mw.com.Skeleton.StopOfferService .. grid-item-card:: Failure Effect A wrong service is stop offered. This means that another service might no longer be found, even though it should be found. It could also cause garbage data, depending on the service discovery mechanism. This could cause a complete loss of functionality and influence customer functions .. grid:: 1 .. grid-item-card:: Description A skeleton is stop offering a service under wrong IDs. This can include a service id, a instance id or also the service version. .. rubric:: Root Cause Analysis .. uml:: stop_offer_on_wrong_ids_fta.puml .. dropdown:: Communication.MethodSignatureElementPtrFailsToFree :name: fmea-communication-methodsignatureelementptrfailstofree .. grid:: 2 :gutter: 3 .. grid-item:: :class: sd-text-center :bdg-warning:`ASIL B` .. grid-item-card:: Failure Effect Failing to free resources can lead to a loss of function as no further method calls could be processed. This does not harm a safety goal. But freeing the wrong resources could lead to This could harm any safety goal. .. grid:: 1 .. grid-item-card:: Description On destruction of a MethodSignatureElementPtr wrong memory is freed or not freed at all. .. rubric:: Root Cause Analysis .. uml:: failure_freeing_resources_on_destruction_fta.puml .. dropdown:: Communication.MethodSignatureElementPtrWrongTarget :name: fmea-communication-methodsignatureelementptrwrongtarget .. grid:: 2 :gutter: 3 .. grid-item:: :class: sd-text-center :bdg-warning:`ASIL B` .. grid-item-card:: Failure Effect Resolution of the smart pointer to the wrong memory location, leads to garbage data access. This could harm any safety goal. .. grid:: 1 .. grid-item-card:: Description On de-referencing of a MethodSignatureElementPtr wrong data is returned. .. rubric:: Root Cause Analysis .. uml:: points_to_wrong_data_fta.puml .. dropdown:: Communication.DoesNotFreeResourcesOnDestruction :name: fmea-communication-doesnotfreeresourcesondestruction .. grid:: 2 :gutter: 3 .. grid-item:: :class: sd-text-center :bdg-warning:`ASIL B` .. grid-item-card:: Failure Effect Resource exhaustion. Could block further communication which could lead to failures on provider and consumer side, which on the other hand could lead to a violation of a safety goal. .. grid:: 1 .. grid-item-card:: Description A SampleAllocateePtr or SamplePtr is destroyed, which should lead to a freeing of resources, but caused by a fault they are not freed. .. rubric:: Root Cause Analysis .. uml:: does_not_free_resources_on_destruction_fta.puml .. dropdown:: Communication.ReturnsWrongData :name: fmea-communication-returnswrongdata .. grid:: 2 :gutter: 3 .. grid-item:: :class: sd-text-center :bdg-warning:`ASIL B` .. grid-item-card:: Failure Effect If you cannot trust the data in the smart pointer, then the data can be garbage, which could break safe communication, which could harm any safety goal. .. grid:: 1 .. grid-item-card:: Description On dereferenciation of a SamplePtr or SampleAllocateePtr wrong data is returned. .. rubric:: Root Cause Analysis .. uml:: returns_wrong_data_fta.puml .. dropdown:: Communication.AnyFunctionBlocksLongerThanExpected :name: fmea-communication-anyfunctionblockslongerthanexpected .. grid:: 2 :gutter: 3 .. grid-item:: :class: sd-text-center :bdg-warning:`ASIL B` .. grid-item-card:: Failure Effect This could cause a hold of parts or the whole system. .. grid:: 1 .. grid-item-card:: Description Any API of mw::com (LoLa) blocks longer than expected (or indefinite) .. dropdown:: Communication.FunctionCalledFromMultipleThreads :name: fmea-communication-functioncalledfrommultiplethreads .. grid:: 2 :gutter: 3 .. grid-item:: :class: sd-text-center :bdg-warning:`ASIL B` .. grid-item-card:: Failure Effect This can lead to race-conditions which can cause data-corruption or data-loss, which could lead to a violation of any safety goal. .. grid:: 1 .. grid-item-card:: Description Any API is called within multiple threads concurrently without any further synchronization. .. dropdown:: Communication.GeneratedCodeDoesNotMatchGenerationInputs :name: fmea-communication-generatedcodedoesnotmatchgenerationinputs .. grid:: 2 :gutter: 3 .. grid-item:: :class: sd-text-center :bdg-warning:`ASIL B` .. grid-item-card:: Failure Effect A faulty configuration which does not lead to compile issues could lead to safety issues according to analysis. .. grid:: 1 .. grid-item-card:: Description Proxys and Skeletons as data-types are generated using the aragen and not handwritten, may not match to the input (Meta-Model). .. dropdown:: Communication.MisusedApis :name: fmea-communication-misusedapis .. grid:: 2 :gutter: 3 .. grid-item:: :class: sd-text-center :bdg-warning:`ASIL B` .. grid-item-card:: Failure Effect Calling non-public APIs or calling them in the wrong context can lead to un-predictable side-effects. This could cause in the worst case transmitting garbage data, which could cause a violation of any safety goal. .. grid:: 1 .. grid-item-card:: Description APIs are invoked in either an invalid context or non public APIs are invoked. .. dropdown:: Communication.ServiceOfferingNotStopped :name: fmea-communication-serviceofferingnotstopped .. grid:: 2 :gutter: 3 .. grid-item:: :class: sd-text-center :bdg-warning:`ASIL B` .. grid-item-card:: Failure Effect A service is found by a consumer, even though it shall no longer be found. This shall have no bad influence, since then no data will be send. .. grid:: 1 .. grid-item-card:: Description A skeleton offered a service, but the stop offering did not work. .. dropdown:: Communication.ServiceStopOfferedOnWrongBinding :name: fmea-communication-servicestopofferedonwrongbinding .. grid:: 2 :gutter: 3 .. grid-item:: :class: sd-text-center :bdg-warning:`ASIL B` .. grid-item-card:: Failure Effect A service is found by a consumer, even though it shall no longer be found. This shall have no bad influence, since then no data will be send. On the other (wrong) binding, no effect will happen, since the service was never offered here anyhow. .. grid:: 1 .. grid-item-card:: Description A skeleton is stop offering a service on the wrong binding. Meaning, the service is still offered on the actual binding. .. dropdown:: Communication.WronglyAlignedMemoryAllocated :name: fmea-communication-wronglyalignedmemoryallocated .. grid:: 2 :gutter: 3 .. grid-item:: :class: sd-text-center :bdg-warning:`ASIL B` .. grid-item-card:: Failure Effect This could cause transmitting garbage data between processes, causing a complete outage of the system. In the worst case the safety goal could be violated. .. grid:: 1 .. grid-item-card:: Description The memory for an event/field is allocated in a wrongly aligned manner. .. dropdown:: Communication.TooMuchMemoryAllocated :name: fmea-communication-toomuchmemoryallocated .. grid:: 2 :gutter: 3 .. grid-item:: :class: sd-text-center :bdg-warning:`ASIL B` .. grid-item-card:: Failure Effect While to much memory has no immediate bad effect, this could cause an overall resource exhaustion within the system. .. grid:: 1 .. grid-item-card:: Description There is too much memory allocated for one event/field .. dropdown:: Communication.AllocatesAlreadyAllocatedMemory :name: fmea-communication-allocatesalreadyallocatedmemory .. grid:: 2 :gutter: 3 .. grid-item:: :class: sd-text-center :bdg-warning:`ASIL B` .. grid-item-card:: Failure Effect This could cause transmitting garbage data between processes, causing a complete outage of the system. In the worst case the safety goal could be violated. .. grid:: 1 .. grid-item-card:: Description The memory for an event/field is allocated from already allocated memory (not free memory). .. dropdown:: Communication.SendingAnEventOrFieldSendsDataOnlyPartially :name: fmea-communication-sendinganeventorfieldsendsdataonlypartially .. grid:: 2 :gutter: 3 .. grid-item:: :class: sd-text-center :bdg-warning:`ASIL B` .. grid-item-card:: Failure Effect This could cause transmitting garbage data between processes, causing a complete outage of the system. In the worst case the safety goal could be violated. .. grid:: 1 .. grid-item-card:: Description Data that is send by the user, only reaches partially the consumer. This can happen in two ways, only a partial number of consumers see the data or all consumers see only partial data. .. dropdown:: Communication.SendingAnEventOrFieldSendsSameSampleNtimes :name: fmea-communication-sendinganeventorfieldsendssamesamplentimes .. grid:: 2 :gutter: 3 .. grid-item:: :class: sd-text-center :bdg-warning:`ASIL B` .. grid-item-card:: Failure Effect This could cause transmitting garbage data between processes, causing a complete outage of the system. In the worst case the safety goal could be violated. .. grid:: 1 .. grid-item-card:: Description Instead of sending a sample (one data point) only once, it is send multiple times. .. dropdown:: Communication.EarlyCleanUp :name: fmea-communication-earlycleanup .. grid:: 2 :gutter: 3 .. grid-item:: :class: sd-text-center :bdg-warning:`ASIL B` .. grid-item-card:: Failure Effect This could cause transmitting garbage data between processes, causing a complete outage of the system. In the worst case the safety goal could be violated. .. grid:: 1 .. grid-item-card:: Description Resources are freed while still being used. .. dropdown:: Communication.StartedFindServiceIsNotStopped :name: fmea-communication-startedfindserviceisnotstopped .. grid:: 2 :gutter: 3 .. grid-item:: :class: sd-text-center :bdg-warning:`ASIL B` .. grid-item-card:: Failure Effect StartFindService handler will be called, even though it is expected that it is not called. .. grid:: 1 .. grid-item-card:: Description A user called "StartFindService" with a given handler, and since "StopFindService" does not work, services can still be found. .. dropdown:: Communication.WrongStartfindserviceIsStopped :name: fmea-communication-wrongstartfindserviceisstopped .. grid:: 2 :gutter: 3 .. grid-item:: :class: sd-text-center :bdg-warning:`ASIL B` .. grid-item-card:: Failure Effect That services are not found, even though they are offered and that services are no longer offered. .. grid:: 1 .. grid-item-card:: Description The handle provided to StopFindService, is identified as another one and thus stops the wrong service discovery query. .. dropdown:: Communication.DoesNotSubscribe :name: fmea-communication-doesnotsubscribe .. grid:: 2 :gutter: 3 .. grid-item:: :class: sd-text-center :bdg-warning:`ASIL B` .. grid-item-card:: Failure Effect A proxy will not be notified over new data. - This will lead to subscription state not changing to subscribed. And therefor a client application will not be able to access samples. This will lead to not receiving any safety relevant information, causing any possible safety goal violation. - Necessary resources might be blocked even though they are not reserved, causing potential blocks of other subscribers. .. grid:: 1 .. grid-item-card:: Description A proxy does not subscribe to a skeleton. Thus, a skeleton does not know that a proxy is interested in data. .. dropdown:: Communication.ReceiveHandlerNotInvoked :name: fmea-communication-receivehandlernotinvoked .. grid:: 2 :gutter: 3 .. grid-item:: :class: sd-text-center :bdg-warning:`ASIL B` .. grid-item-card:: Failure Effect It is possible that no event data is received ever and thus any safety issues are possible. .. grid:: 1 .. grid-item-card:: Description A proxy has set a receive handler and a skeleton is updating an event, but the receive handler is never invoked. .. dropdown:: Communication.ReceiveHandlerInvokedWithWrongEvent :name: fmea-communication-receivehandlerinvokedwithwrongevent .. grid:: 2 :gutter: 3 .. grid-item:: :class: sd-text-center :bdg-warning:`ASIL B` .. grid-item-card:: Failure Effect The only implication that this has are resource wise on timing. So a always notified handler could block one thread and thus make the overall system way more slow. The safety concept of the whole system supervises timely violations and ensures that no safety goal is harmed. .. grid:: 1 .. grid-item-card:: Description A receive handler registered for an event, gets called because of an update of an different event. .. dropdown:: Communication.ReceiveHandlerInvokedMultipleTimes :name: fmea-communication-receivehandlerinvokedmultipletimes .. grid:: 2 :gutter: 3 .. grid-item:: :class: sd-text-center :bdg-warning:`ASIL B` .. grid-item-card:: Failure Effect The only implication that this has are ressource wise on timing. So a always notified handler could block one thread and thus make the overall system way more slow. The safety concept of the whole system supervises timely violations and ensures that no safety goal is harmed. .. grid:: 1 .. grid-item-card:: Description A receive handler is invoked multiple times, even though only one event update happend. .. dropdown:: Communication.ReceiveHandlerInvokedWithoutEventNotification :name: fmea-communication-receivehandlerinvokedwithouteventnotification .. grid:: 2 :gutter: 3 .. grid-item:: :class: sd-text-center :bdg-warning:`ASIL B` .. grid-item-card:: Failure Effect A receive handler is invoked, even though no new events are available. The only implication that this has are ressource wise on timing. So a always notified handler could block one thread and thus make the overall system way more slow. .. grid:: 1 .. grid-item-card:: Description A receive handler is invoked, even though no event update happend. .. dropdown:: Communication.UsesToManySampleptr :name: fmea-communication-usestomanysampleptr .. grid:: 2 :gutter: 3 .. grid-item:: :class: sd-text-center :bdg-warning:`ASIL B` .. grid-item-card:: Failure Effect Synchronization algorithm can no longer hold guarantees, which can cause an exceeding of resources. In worst case another proxy might fail to get updated samples (messages lost without full queues aka not detectable). .. grid:: 1 .. grid-item-card:: Description User is already max. sample count SamplePtr, but we are still handing out SamplePtrs in callback F(). .. dropdown:: Communication.ReturnsWrongSampleCount :name: fmea-communication-returnswrongsamplecount .. grid:: 2 :gutter: 3 .. grid-item:: :class: sd-text-center :bdg-warning:`ASIL B` .. grid-item-card:: Failure Effect Potential Data loss with unknown effect on safety goals. .. grid:: 1 .. grid-item-card:: Description Value returned by GetNewSample() does not match with the number of calls to callback F(). .. dropdown:: Communication.SucceedsDespiteAnError :name: fmea-communication-succeedsdespiteanerror .. grid:: 2 :gutter: 3 .. grid-item:: :class: sd-text-center :bdg-warning:`ASIL B` .. grid-item-card:: Interface mw.com.Event.GetNewSamples .. grid-item-card:: Failure Effect Receive a sample count instead of an error, implies that the sample count is wrong. Receiving an error instead of a sample count, implies that the sample count is wrong. .. grid:: 1 .. grid-item-card:: Description A user calls GetNewSamples() on a proxy instance and receives a sample count, even though he should have received an error. .. dropdown:: Communication.ReturnsWrongFreeSampleCount :name: fmea-communication-returnswrongfreesamplecount .. grid:: 2 :gutter: 3 .. grid-item:: :class: sd-text-center :bdg-warning:`ASIL B` .. grid-item-card:: Failure Effect It would be no longer possible to detect message losses on full queues. .. grid:: 1 .. grid-item-card:: Description A user has already M SamplePtr in use from a max. announced number N, but GetFreeSampleCount() returns a different value than N-M. .. dropdown:: Communication.UnsubscribesFromWrongEvent :name: fmea-communication-unsubscribesfromwrongevent .. grid:: 2 :gutter: 3 .. grid-item:: :class: sd-text-center :bdg-warning:`ASIL B` .. grid-item-card:: Failure Effect Same as Failuremode SubscribeToWrongEvent .. grid:: 1 .. grid-item-card:: Description A user unsubscribes from an event, but the unsubscribe is silently carried out on another event. .. dropdown:: Communication.DoesNotImplicitRemoveReceiveHandler :name: fmea-communication-doesnotimplicitremovereceivehandler .. grid:: 2 :gutter: 3 .. grid-item:: :class: sd-text-center :bdg-warning:`ASIL B` .. grid-item-card:: Failure Effect Invocation of invalid receive handler, because it no longer exists. This could have any bad potential side effects. .. grid:: 1 .. grid-item-card:: Description A proxy has registered a receive handler and unsubscribes, this should lead to the case that a receive handler is no longer called. In this failure mode, the receive handler would still be called. .. dropdown:: Communication.IncompleteMapOfEvents :name: fmea-communication-incompletemapofevents .. grid:: 2 :gutter: 3 .. grid-item:: :class: sd-text-center :bdg-warning:`ASIL B` .. grid-item-card:: Failure Effect Due to the map not complete, this will lead to missed data, because the user is not aware that these events are actually there. This could affect any safety goal. .. grid:: 1 .. grid-item-card:: Description The user gets presented not all events the generic proxy supports. .. dropdown:: Communication.TheSizeReturnedIsSmallerThenTheActualSize :name: fmea-communication-thesizereturnedissmallerthentheactualsize .. grid:: 2 :gutter: 3 .. grid-item:: :class: sd-text-center :bdg-warning:`ASIL B` .. grid-item-card:: Interface mw.com.GenericProxyEvent.GetSampleSize .. grid-item-card:: Failure Effect Only seeing a subset of the data, thus a potential violation of any safety goal. .. grid:: 1 .. grid-item-card:: Description The user receives a size, that is smaller then the actual value. .. dropdown:: Communication.WrongIndicationIfFormatIsSerialized :name: fmea-communication-wrongindicationifformatisserialized .. grid:: 2 :gutter: 3 .. grid-item:: :class: sd-text-center :bdg-warning:`ASIL B` .. grid-item-card:: Interface mw.com.GenericProxyEvent.HasSerializedFormat .. grid-item-card:: Failure Effect Missinterpretation of data, can lead to any safety violation. .. grid:: 1 .. grid-item-card:: Description A user, using HasSerializedFormat(), receives the wrong value. .. dropdown:: Communication.FreesWrongResources :name: fmea-communication-freeswrongresources .. grid:: 2 :gutter: 3 .. grid-item:: :class: sd-text-center :bdg-warning:`ASIL B` .. grid-item-card:: Failure Effect Communication of data-garbage or resource exhaustion, which both could harm an overall safety goal. .. grid:: 1 .. grid-item-card:: Description A SampleAllocateePtr or SamplePtr free the wrong resources associated with them. .. dropdown:: Communication.DoesNotReserveResources :name: fmea-communication-doesnotreserveresources .. grid:: 2 :gutter: 3 .. grid-item:: :class: sd-text-center :bdg-warning:`ASIL B` .. grid-item-card:: Failure Effect Data is manipulated from different processes because they think its not owned. Which could cause garbage data and thus harm any safety goal. .. grid:: 1 .. grid-item-card:: Description A SamplePtr or SampleAllocateePtr do not increase their respective ref-counts and thus avoid data changes. .. dropdown:: Communication.DoesNotUpdateFreeSampleCountCorrectly :name: fmea-communication-doesnotupdatefreesamplecountcorrectly .. grid:: 2 :gutter: 3 .. grid-item:: :class: sd-text-center :bdg-warning:`ASIL B` .. grid-item-card:: Failure Effect Users may not know, if they are allowed to retrieve new Samples at all and may therefore fail to get new data! This may violate any safety goal. .. grid:: 1 .. grid-item-card:: Description When a SamplePtr gets created or destroyed for a given event instance, the Free Sample Count of this instance doesn't get updated accordingly