Failure Modes#

Coverage: 98.6% (70 of 71 items OK)

[MISSING] TRLC Failuremode Communication.SendingAnEventOrFieldSendsSameSampleNtimes

Instead of sending a sample (one data point) only once, it is send multiple times.

Traces to:

  • missing reference to Root Causes

Source: score/mw/com/dependability/safety_analysis/failure_modes.trlc:301:34

[OK] TRLC Failuremode Communication.AnyFunctionBlocksLongerThanExpected

Any API of mw::com (LoLa) blocks longer than expected (or indefinite)

Traces to:

Source: score/mw/com/dependability/safety_analysis/failure_modes.trlc:20:26

[OK] TRLC Failuremode Communication.InMemoryConfigurationWrong

The in-memory (cpp representation) does not match the on file-system JSON configuration.

Traces to:

Source: score/mw/com/dependability/safety_analysis/failure_modes.trlc:31:26

[OK] TRLC Failuremode Communication.FunctionCalledFromMultipleThreads

Any API is called within multiple threads concurrently without any further synchronization.

Traces to:

Source: score/mw/com/dependability/safety_analysis/failure_modes.trlc:42:26

[OK] TRLC Failuremode Communication.CodeDoesNotMatchConfiguration

Definitions of service-interfaces may not match the given mw::com configuration.

Traces to:

Source: score/mw/com/dependability/safety_analysis/failure_modes.trlc:53:26

[OK] TRLC Failuremode Communication.MisusedApis

APIs are invoked in either an invalid context or non public APIs are invoked.

Traces to:

Source: score/mw/com/dependability/safety_analysis/failure_modes.trlc:64:26

[OK] TRLC Failuremode Communication.CreationOfSkeletonNotPossible

It is not possible to create a skeleton instance

Traces to:

Source: score/mw/com/dependability/safety_analysis/failure_modes.trlc:79:34

[OK] TRLC Failuremode Communication.ServiceOfferedWithoutInitialFieldValue

A service is offered, although at least one of its field has no initial value set by the provider.

Traces to:

Source: score/mw/com/dependability/safety_analysis/failure_modes.trlc:93:34

[OK] TRLC Failuremode Communication.ServiceNotOffered

A skeleton service is offering a service, but the service is silently not offered. Note: offered in this case means, that it is also connectable

Traces to:

Source: score/mw/com/dependability/safety_analysis/failure_modes.trlc:104:34

[OK] TRLC Failuremode Communication.ServiceOfferedOnWrongBinding

A skeleton is offering a service on the wrong binding. Meaning, the service is not offered on the intended binding, but on an unintended one.

Traces to:

Source: score/mw/com/dependability/safety_analysis/failure_modes.trlc:115:34

[OK] TRLC Failuremode Communication.ServiceOfferedUnderWrongIds

A skeleton is offering a service with wrong identifiers. This can include a service id, a instance id or also the service version.

Traces to:

Source: score/mw/com/dependability/safety_analysis/failure_modes.trlc:126:34

[OK] TRLC Failuremode Communication.OffersAlreadyOfferedService

A skeleton offers a service that was already offered. Either by another process or by itself.

Traces to:

Source: score/mw/com/dependability/safety_analysis/failure_modes.trlc:137:34

[OK] TRLC Failuremode Communication.ServiceOnlyPartiallyOffered

A skeleton offers a service, which is not visible to all consumers, but only to parts of them.

Traces to:

Source: score/mw/com/dependability/safety_analysis/failure_modes.trlc:148:34

[OK] TRLC Failuremode Communication.StopOfferNotStoppedInSD

A service instance was offered via service discovery, but it wasn’t withdrawn from service discovery in the stop offer.

Traces to:

Source: score/mw/com/dependability/safety_analysis/failure_modes.trlc:160:34

[OK] TRLC Failuremode Communication.StopOfferWrongInstanceStoppedInSD

Same as in StopOfferNotStoppedInSD. Additionally another service instance, which is still being offered, is withdrawn from service discovery.

Traces to:

Source: score/mw/com/dependability/safety_analysis/failure_modes.trlc:169:34

[OK] TRLC Failuremode Communication.StopOfferUnlinkWrongSHMObjects

Skeleton instance did unlink shared memory objects which do not belong to the service instance being stop offered.

Traces to:

Source: score/mw/com/dependability/safety_analysis/failure_modes.trlc:178:34

[OK] TRLC Failuremode Communication.StopOfferInconsistent

Skeleton instance is in an inconsistent state after stop offering: Either the stop offer was not forwarded to the binding or failed at the binding. Or it wasn’t forwarded to the dependent service elements or their bindings or failed at them.

Traces to:

Source: score/mw/com/dependability/safety_analysis/failure_modes.trlc:187:34

[OK] TRLC Failuremode Communication.MemoryAllocatedInWrongSection

The memory for an event is allocated in the wrong memory section (e.g. in Heap, another Shared Memory segment or the stack).

Traces to:

Source: score/mw/com/dependability/safety_analysis/failure_modes.trlc:200:34

[OK] TRLC Failuremode Communication.TooFewMemoryAllocated

The event allocation allocates too few memory (including no memory at all).

Traces to:

Source: score/mw/com/dependability/safety_analysis/failure_modes.trlc:210:34

[OK] TRLC Failuremode Communication.WronglyAlignedMemoryAllocated

The memory for an event/field is allocated in a wrongly aligned manner.

Traces to:

Source: score/mw/com/dependability/safety_analysis/failure_modes.trlc:221:34

[OK] TRLC Failuremode Communication.TooMuchMemoryAllocated

There is too much memory allocated for one event/field

Traces to:

Source: score/mw/com/dependability/safety_analysis/failure_modes.trlc:232:34

[OK] TRLC Failuremode Communication.AllocatesAlreadyAllocatedMemory

The memory for an event/field is allocated from already allocated memory (not free memory).

Traces to:

Source: score/mw/com/dependability/safety_analysis/failure_modes.trlc:243:34

[OK] TRLC Failuremode Communication.SendingEventChangesUserData

A call to send manipulates the data that was provided by the caller.

Traces to:

Source: score/mw/com/dependability/safety_analysis/failure_modes.trlc:257:34

[OK] TRLC Failuremode Communication.SendingAnEventOrFieldSendsDataOnlyPartially

Data that is send by the user, only reaches partially the consumer. This can happen in two ways, only a partial number of consumers see the data or all consumers see only partial data.

Traces to:

Source: score/mw/com/dependability/safety_analysis/failure_modes.trlc:268:34

[OK] TRLC Failuremode Communication.SendingEventOnlyPartiallyNotifiesConsumer

When data is sent, consumers that have a callback registered, are only partially notified.

Traces to:

Source: score/mw/com/dependability/safety_analysis/failure_modes.trlc:279:34

[OK] TRLC Failuremode Communication.SendingEventSendsToWrongConsumer

An event or field is sent to the wrong consumer.

Traces to:

Source: score/mw/com/dependability/safety_analysis/failure_modes.trlc:290:34

[OK] TRLC Failuremode Communication.SendingEventDoesNotFreeResources

Resources in the middleware that have been allocated with a previous allocation, are not freed after returning from send/update.

Traces to:

Source: score/mw/com/dependability/safety_analysis/failure_modes.trlc:312:34

[OK] TRLC Failuremode Communication.WrongResourcesFreed

A destruction of one skeleton instances, frees the resources of another skeleton instance.

Traces to:

Source: score/mw/com/dependability/safety_analysis/failure_modes.trlc:326:34

[OK] TRLC Failuremode Communication.NoResourcesFreed

The resources allocated on construction and during operation are not freed on destruction.

Traces to:

Source: score/mw/com/dependability/safety_analysis/failure_modes.trlc:337:34

[OK] TRLC Failuremode Communication.EarlyCleanUp

Resources are freed while still being used.

Traces to:

Source: score/mw/com/dependability/safety_analysis/failure_modes.trlc:348:34

[OK] TRLC Failuremode Communication.WrongMethodInArgsUsed

Unintended input arguments are used in a service method call. Therefore, the method call gets executed with wrong input data.

Traces to:

Source: score/mw/com/dependability/safety_analysis/failure_modes.trlc:368:34

[OK] TRLC Failuremode Communication.WrongMethodCalled

Either the wrong user provided method handler is called or no user handler is called at all. Therefore, the method call results are invalid/garbage.

Traces to:

Source: score/mw/com/dependability/safety_analysis/failure_modes.trlc:384:34

[OK] TRLC Failuremode Communication.WrongResultsProvided

The result of a method call is either not provided in the expected location, leaving uninitialized data in the expected location or it is provided in an inconsistent state. Therefore, the method call results are invalid/garbage.

Traces to:

Source: score/mw/com/dependability/safety_analysis/failure_modes.trlc:402:34

[OK] TRLC Failuremode Communication.StartFindServiceCallbackCalledUnexpectedly

The user-provided callback is invoked, even though it should not be invoked.

Traces to:

Source: score/mw/com/dependability/safety_analysis/failure_modes.trlc:418:34

[OK] TRLC Failuremode Communication.ServiceNotFound

A proxy does not find a service instance, even though it was offered by a skeleton.

Traces to:

Source: score/mw/com/dependability/safety_analysis/failure_modes.trlc:432:34

[OK] TRLC Failuremode Communication.WrongServiceFound

A proxy instance finds a wrong service. This could be either a wrong service instance or a completely wrong service.

Traces to:

Source: score/mw/com/dependability/safety_analysis/failure_modes.trlc:443:34

[OK] TRLC Failuremode Communication.ServiceIsFoundButDoesNotExist

Finding a service, returns a service, even though no service instance was offered.

Traces to:

Source: score/mw/com/dependability/safety_analysis/failure_modes.trlc:454:34

[OK] TRLC Failuremode Communication.ProxyCannotBeCreatedWithValidHandleWhenServiceIsOffered

After finding a service and getting a valid handle (and the service has not been since or is currently being stop offered), creating a proxy with that handle fails.

Traces to:

Source: score/mw/com/dependability/safety_analysis/failure_modes.trlc:467:34

[OK] TRLC Failuremode Communication.StartedFindServiceIsNotStopped

A user called “StartFindService” with a given handler, and since “StopFindService” does not work, services can still be found.

Traces to:

Source: score/mw/com/dependability/safety_analysis/failure_modes.trlc:482:34

[OK] TRLC Failuremode Communication.WrongStartfindserviceIsStopped

The handle provided to StopFindService, is identified as another one and thus stops the wrong service discovery query.

Traces to:

Source: score/mw/com/dependability/safety_analysis/failure_modes.trlc:493:34

[OK] TRLC Failuremode Communication.SubscribeToWrongEvent

A service proxy subscribes to a wrong event. This either means that this event does not exist at all, is offered by another service instance, another event in the current instance or a completely different service.

Traces to:

Source: score/mw/com/dependability/safety_analysis/failure_modes.trlc:507:34

[OK] TRLC Failuremode Communication.SubscribeWithWrongMaxSampleCount

A proxy instance subscribes to an event to with a wrong sample count, meaning a different one that was provided by the user.

Traces to:

Source: score/mw/com/dependability/safety_analysis/failure_modes.trlc:517:34

[OK] TRLC Failuremode Communication.DoesNotSubscribe

A proxy does not subscribe to a skeleton. Thus, a skeleton does not know that a proxy is interested in data.

Traces to:

Source: score/mw/com/dependability/safety_analysis/failure_modes.trlc:527:34

[OK] TRLC Failuremode Communication.ReceiveHandlerNotInvoked

A proxy has set a receive handler and a skeleton is updating an event, but the receive handler is never invoked.

Traces to:

Source: score/mw/com/dependability/safety_analysis/failure_modes.trlc:541:34

[OK] TRLC Failuremode Communication.ReceiveHandlerInvokedWithWrongEvent

A receive handler registered for an event, gets called because of an update of an different event.

Traces to:

Source: score/mw/com/dependability/safety_analysis/failure_modes.trlc:553:34

[OK] TRLC Failuremode Communication.ReceiveHandlerInvokedMultipleTimes

A receive handler is invoked multiple times, even though only one event update happend.

Traces to:

Source: score/mw/com/dependability/safety_analysis/failure_modes.trlc:564:34

[OK] TRLC Failuremode Communication.ReceiveHandlerInvokedWithoutEventNotification

A receive handler is invoked, even though no event update happend.

Traces to:

Source: score/mw/com/dependability/safety_analysis/failure_modes.trlc:576:34

[OK] TRLC Failuremode Communication.CallbackNotInvokedDespiteSamplesAvailable

GetNewSamples() gets called on an event with a callback F, but the callback gets called not at all, although at least one new sample is available.

Traces to:

Source: score/mw/com/dependability/safety_analysis/failure_modes.trlc:591:34

[OK] TRLC Failuremode Communication.CallbackInvokedWithWrongData

A proxy receives a sample pointer via callback F(), but the data does not contain the expected one.

Traces to:

Source: score/mw/com/dependability/safety_analysis/failure_modes.trlc:601:34

[OK] TRLC Failuremode Communication.UsesTooManySampleptr

User is already max. sample count SamplePtr, but we are still handing out SamplePtrs in callback F().

Traces to:

Source: score/mw/com/dependability/safety_analysis/failure_modes.trlc:611:34

[OK] TRLC Failuremode Communication.ReturnsWrongSampleCount

Value returned by GetNewSample() does not match with the number of calls to callback F().

Traces to:

Source: score/mw/com/dependability/safety_analysis/failure_modes.trlc:622:34

[OK] TRLC Failuremode Communication.GetNewSamplesSucceedsDespiteAnError

A user calls GetNewSamples() on a proxy instance and receives a sample count, even though he should have received an error.

Traces to:

Source: score/mw/com/dependability/safety_analysis/failure_modes.trlc:633:34

[OK] TRLC Failuremode Communication.ReturnsWrongFreeSampleCount

A user has already M SamplePtr in use from a max. announced number N, but GetFreeSampleCount() returns a different value than N-M.

Traces to:

Source: score/mw/com/dependability/safety_analysis/failure_modes.trlc:648:34

[OK] TRLC Failuremode Communication.DoesNotUnsubscribe

A proxy is subscribed to an event, tries to unsubscribe, but silently fails to unsubscribe.

Traces to:

Source: score/mw/com/dependability/safety_analysis/failure_modes.trlc:662:34

[OK] TRLC Failuremode Communication.UnsubscribesFromWrongEvent

A user unsubscribes from an event, but the unsubscribe is silently carried out on another event.

Traces to:

Source: score/mw/com/dependability/safety_analysis/failure_modes.trlc:672:34

[OK] TRLC Failuremode Communication.DoesNotImplicitRemoveReceiveHandler

A proxy has registered a receive handler and unsubscribes, this should lead to the case that a receive handler is no longer called. In this failure mode, the receive handler would still be called.

Traces to:

Source: score/mw/com/dependability/safety_analysis/failure_modes.trlc:683:34

[OK] TRLC Failuremode Communication.MapContainingNonexistentEvents

The map that is visible to the user, contains events that are not actually existing (e.g. in the configuration).

Traces to:

Source: score/mw/com/dependability/safety_analysis/failure_modes.trlc:699:38

[OK] TRLC Failuremode Communication.IncompleteMapOfEvents

The user gets presented not all events the generic proxy supports.

Traces to:

Source: score/mw/com/dependability/safety_analysis/failure_modes.trlc:709:38

[OK] TRLC Failuremode Communication.TheSizeReturnedIsBiggerThenTheActualValue

The user receives a size, that is bigger then the actual value.

Traces to:

Source: score/mw/com/dependability/safety_analysis/failure_modes.trlc:723:38

[OK] TRLC Failuremode Communication.TheSizeReturnedIsSmallerThenTheActualSize

The user receives a size, that is smaller then the actual value.

Traces to:

Source: score/mw/com/dependability/safety_analysis/failure_modes.trlc:734:38

[OK] TRLC Failuremode Communication.WrongIndicationIfFormatIsSerialized

A user, using HasSerializedFormat(), receives the wrong value.

Traces to:

Source: score/mw/com/dependability/safety_analysis/failure_modes.trlc:746:38

[OK] TRLC Failuremode Communication.MethodCallBlocksLongerThanExpected

A call to a service-method on the client/consumer side blocks longer than expected (or indefinite). This is a specific instance of FailureMode [AnyFunctionBlocksLongerThanExpected], but since with service-methods we have concrete root causes in the form of message-passing behaviour and behaviour of user-provided handler, we have this specific failure mode.

Traces to:

Source: score/mw/com/dependability/safety_analysis/failure_modes.trlc:762:34

[OK] TRLC Failuremode Communication.WrongMethodInArgsProvided

Unintended input arguments are provided to a service method call. Therefore, the method call gets executed with wrong input data.

Traces to:

Source: score/mw/com/dependability/safety_analysis/failure_modes.trlc:779:34

[OK] TRLC Failuremode Communication.WrongReturnValueUsed

Unintended results are provided from a service method call. Therefore, the caller of the method works on wrong data.

Traces to:

Source: score/mw/com/dependability/safety_analysis/failure_modes.trlc:796:34

[OK] TRLC Failuremode Communication.DoesNotFreeResourcesOnDestruction

A SampleAllocateePtr or SamplePtr is destroyed, which should lead to a freeing of resources, but caused by a fault they are not freed.

Traces to:

Source: score/mw/com/dependability/safety_analysis/failure_modes.trlc:816:34

[OK] TRLC Failuremode Communication.FreesWrongResources

A SampleAllocateePtr or SamplePtr free the wrong resources associated with them.

Traces to:

Source: score/mw/com/dependability/safety_analysis/failure_modes.trlc:826:34

[OK] TRLC Failuremode Communication.DoesNotReserveResources

A SamplePtr or SampleAllocateePtr do not increase their respective ref-counts and thus avoid data changes.

Traces to:

Source: score/mw/com/dependability/safety_analysis/failure_modes.trlc:837:34

[OK] TRLC Failuremode Communication.DoesNotUpdateFreeSampleCountCorrectly

When a SamplePtr gets created or destroyed for a given event instance, the Free Sample Count of this instance doesn’t get updated accordingly

Traces to:

Source: score/mw/com/dependability/safety_analysis/failure_modes.trlc:848:34

[OK] TRLC Failuremode Communication.ReturnsWrongData

On dereferenciation of a SamplePtr or SampleAllocateePtr wrong data is returned.

Traces to:

Source: score/mw/com/dependability/safety_analysis/failure_modes.trlc:858:34

[OK] TRLC Failuremode Communication.MethodSignatureElementPtrWrongTarget

On de-referencing of a MethodSignatureElementPtr wrong data is returned.

Traces to:

Source: score/mw/com/dependability/safety_analysis/failure_modes.trlc:878:34

[OK] TRLC Failuremode Communication.MethodSignatureElementPtrFailsToFree

On destruction of a MethodSignatureElementPtr wrong memory is freed or not freed at all.

Traces to:

Source: score/mw/com/dependability/safety_analysis/failure_modes.trlc:893:34