message_passing_fmea

Overview

Failure Mode	Guideword	ASIL	Interface
IpcChannelUnavailable		B	IServer.StartListening, IServer.StopListening, IClientFactory.Create, IClientConnection.Start, IClientConnection.Stop, IServerConnection.RequestDisconnect
MessageNotDeliveredCorrectly		B	IServerConnection.Reply, IClientConnection.Send, IClientConnection.SendWaitReply, IClientConnection.SendWithCallback
NotificationNotDelivered		B	IServerConnection.Notify, IClientConnection.Start
ServerMessageHandlingFailure		B	IServer.StartListening, IConnectionHandler.OnMessageSent, IConnectionHandler.OnMessageSentWithReply
MessageTimingViolated		B	IServerConnection.Reply
IpcApiMisuseOrLifecycleViolation		B	IClientConnection.Send, IClientConnection.SendWaitReply, IClientConnection.SendWithCallback, IClientConnection.Restart, IServerConnection.Reply, IServerConnection.RequestDisconnect
ConnectionContextDataWrong		B	IServerConnection.GetClientIdentity, IServerConnection.GetUserData
StateMachineError		B	IClientConnection.GetState, IClientConnection.GetStopReason

Failure Modes

MessagePassing.ConnectionContextDataWrong

ASIL B

Interface

IServerConnection.GetClientIdentity, IServerConnection.GetUserData

Failure Effect

The server makes access control or application logic decisions based on wrong context data; the client may be incorrectly granted or denied access, or receive incorrect responses, potentially violating safety goals.

Description

Identity or cached context data associated with a server connection is absent, incomplete, or incorrect.

Root Cause Analysis

MessagePassing.IpcApiMisuseOrLifecycleViolation

ASIL B

Interface

IClientConnection.Send, IClientConnection.SendWaitReply, IClientConnection.SendWithCallback, IClientConnection.Restart, IServerConnection.Reply, IServerConnection.RequestDisconnect

Failure Effect

Undefined behavior, silent message drop, or application crash; unexpected messages may corrupt application-level protocol state.

Description

An IPC operation is invoked at the wrong lifecycle stage or outside its valid call context.

Root Cause Analysis

MessagePassing.IpcChannelUnavailable

ASIL B

Interface

IServer.StartListening, IServer.StopListening, IClientFactory.Create, IClientConnection.Start, IClientConnection.Stop, IServerConnection.RequestDisconnect

Failure Effect

Clients cannot send or receive messages.

Description

The IPC channel between client and server cannot be established or maintained

Root Cause Analysis

MessagePassing.MessageNotDeliveredCorrectly

ASIL B

Interface

IServerConnection.Reply, IClientConnection.Send, IClientConnection.SendWaitReply, IClientConnection.SendWithCallback

Failure Effect

The receiver processes no data, incomplete data, or incorrect data; messages may also be routed to an unintended server instance. Application behavior may be incorrect or a safety goal may be violated.

Description

A message sent via the IPC channel is not, only partially with corrupted content delivered.

Root Cause Analysis

Control Measures

OsIpcFaultHandling ASIL B

The component shall detect OS IPC transport failures by checking the return value of every OS call.

SendBufferArgumentValidation ASIL B

The component shall validate all arguments of Send, SendWaitReply, and SendWithCallback before any IPC operation is initiated.

MessagePassing.MessageTimingViolated

ASIL B

Interface

IServerConnection.Reply

Failure Effect

FTTI violations may occur on safety-relevant communication paths.

Description

A message or reply is delivered outside of the specified timing bounds required by the application.

Root Cause Analysis

MessagePassing.NotificationNotDelivered

ASIL B

Interface

IServerConnection.Notify, IClientConnection.Start

Failure Effect

The client misses an asynchronous server event or acts on incomplete, corrupted, stale, or spurious notification data; application behavior may be incorrect or a safety goal may be violated.

Description

A server-initiated notification is not, only partially, delayed, with corrupted content or when not intended delivered.

Root Cause Analysis

MessagePassing.ServerMessageHandlingFailure

ASIL B

Interface

IServer.StartListening, IConnectionHandler.OnMessageSent, IConnectionHandler.OnMessageSentWithReply

Failure Effect

Request message is silently dropped or never answered; the client’s SendWaitReply call blocks or times out, stalling potential safety-relevant communication.

Description

Server-side message or connection handler fails to process a received message or to produce a required reply.

Root Cause Analysis

MessagePassing.StateMachineError

ASIL B

Interface

IClientConnection.GetState, IClientConnection.GetStopReason

Failure Effect

Application logic based on connection state makes incorrect decisions; error recovery paths may be triggered incorrectly or missed entirely.

Description

GetState or GetStopReason returns an incorrect lifecycle state that does not match the actual connection state.

Root Cause Analysis

Control Measures

Control Measure	ASIL	Description
OsIpcFaultHandling	B	The component shall detect OS IPC transport failures by checking the return value of every OS call.
SendBufferArgumentValidation	B	The component shall validate all arguments of Send, SendWaitReply, and SendWithCallback before any IPC operation is initiated.
BE_MessageTooBig	B	The component shall enforce the configured max_send_size, max_reply_size, and max_notify_size limits on every client send path and every server Reply and Notify path.
BE_SendQueueExhausted	B	The component shall use a pre-allocated, bounded pool for asynchronous client send messages and return an error when the pool is exhausted without blocking or silently dropping the message.