Safety Measures#

Coverage: 73.7% (28 of 38 items OK)

[MISSING] TRLC Aou Communication.NoNotificationOnTerminationOfProducer

It shall be ensured that termination (either gracefully or due to a malfunction) of a producer will not lead to a violation of a safety goal.

Derived from:

  • missing up reference

Source: score/mw/com/dependability/safety_analysis/aou.trlc:228:14

[MISSING] TRLC Aou Communication.NoCopySendWhileHoldingAllocateePtr

It shall be ensured that Send(const& value) is not invoked while an AllocateePtr is held.

Derived from:

  • missing up reference

Source: score/mw/com/dependability/safety_analysis/aou.trlc:280:14

[MISSING] TRLC Aou Communication.NoneReentrantMethodsPerEventInstance

It shall be ensured that any LoLa API that is bound to a specific event instance is not called in a reentrant manner.

Derived from:

  • missing up reference

Source: score/mw/com/dependability/safety_analysis/aou.trlc:288:14

[MISSING] TRLC Aou Communication.UsageOfConfigurationOversubscription

If event instance “oversubscription” is enabled, LoLa makes no warranty that proxies/consumers can’t suffer from data loss! It is the responsibility of the user to adapt scheduling/event-data access in a way that no data-loss happens.

Derived from:

  • missing up reference

Source: score/mw/com/dependability/safety_analysis/aou.trlc:496:14

[MISSING] TRLC Aou Communication.SameCompilerSettingsForProviderAndConsumerSide

All compiler settings having influence on the binary representation of data exchanged via {{mw::com}}/{{LoLa}} (event, field, service-method payloads) have to be identical for compilation of code containing {{mw::com}} proxies and skeletons, which communicate.

Derived from:

  • missing up reference

Source: score/mw/com/dependability/safety_analysis/aou.trlc:504:14

[MISSING] TRLC Aou Communication.EventOrFieldReceptionViaGenericProxyNeedsSpecificCare

When receiving event or field data via untyped {{GenericProxyEvent}} or {{GenericProxyField}}, care has to be taken when accessing the corresponding {{SamplePtr<void>}} delivered by calls to {{GetNewSamples()}}: When casting it to the expected type, it needs to be checked that no access beyond the size provided by the corresponding data type size information will happen.

Derived from:

  • missing up reference

Source: score/mw/com/dependability/safety_analysis/aou.trlc:511:14

[MISSING] TRLC Aou Communication.CorrectlyConfiguredEventsFieldsPerServiceType

It shall be ensured that all safety relevant events/fields in the service type are the same in all configurations.

Derived from:

  • missing up reference

Source: score/mw/com/dependability/safety_analysis/aou.trlc:518:14

[MISSING] TRLC Aou Communication.NoGuaranteeOnSubscriptionStateCorrectness

For safety critical use cases, an application must treat a SubscriptionState of kSubscribed or kSubscriptionPending (returned by GetSubscriptionState() or reported by the SubscriptionStateChangeHandler) as the same.

Derived from:

  • missing up reference

Source: score/mw/com/dependability/safety_analysis/aou.trlc:555:14

[MISSING] TRLC Aou Communication.NoCreationOfServiceElements

It is not allowed to create instances of event, field and method classes on the proxy and skeleton side.

Derived from:

  • missing up reference

Source: score/mw/com/dependability/safety_analysis/aou.trlc:562:14

[MISSING] TRLC Aou Communication.NoMoveOfServiceElements

It is not allowed to move instances of event, field and method classes on the proxy and skeleton side independently of the parent proxy / skeleton.

Derived from:

  • missing up reference

Source: score/mw/com/dependability/safety_analysis/aou.trlc:569:14

[OK] TRLC Aou Communication.MonotonicSemiDynamicMemoryAllocation

It shall be ensured that enough memory is configured for shared memory instances, in order that LoLa can perform all necessary allocations (e.g. push-back on a Vector).

Derived from:

Source: score/mw/com/dependability/safety_analysis/aou.trlc:19:14

[OK] TRLC Aou Communication.CorrectlyConfiguredMaximumNumberOfSubscriber

It shall be ensured that correct maximum number of subscriber is configured for each event for each service instance.

Derived from:

Source: score/mw/com/dependability/safety_analysis/aou.trlc:31:14

[OK] TRLC Aou Communication.CorrectlyConfiguredMaximumNumberOfMaximumElementsPerSubscriber

It shall be ensured that correct maximum number of elements per subscriber is configured for each event for each service instance.

Derived from:

Source: score/mw/com/dependability/safety_analysis/aou.trlc:59:14

[OK] TRLC Aou Communication.CorrectlyConfiguredAsilLevel

It shall be ensured that the ASIL Level on process level and per service instance is correctly configured.

Derived from:

Source: score/mw/com/dependability/safety_analysis/aou.trlc:87:14

[OK] TRLC Aou Communication.OnlyLoLaSupportedTypes

It shall be ensured that only types that are supported by LoLa are transmitted.

Derived from:

Source: score/mw/com/dependability/safety_analysis/aou.trlc:103:14

[OK] TRLC Aou Communication.NoApisFromImplementationNamespace

It shall be ensured that no API calls from the implementation namespace (e.g `impl`) are directly invoked or types from within are directly used.

Derived from:

Source: score/mw/com/dependability/safety_analysis/aou.trlc:126:14

[OK] TRLC Aou Communication.NoGuaranteesForNotifications

It shall be ensured that a miss behavior of event notification will not harm a safety goal.

Derived from:

Source: score/mw/com/dependability/safety_analysis/aou.trlc:137:14

[OK] TRLC Aou Communication.CheckingForPossibleMessageOverflow

It shall be ensured that a message overflow, which results in message loss will not harm a safety goal. If this is not possible, a check for message overflow and necessary actions need to be performed.

Derived from:

Source: score/mw/com/dependability/safety_analysis/aou.trlc:155:14

[OK] TRLC Aou Communication.DifferentUserForAsilAndQmProcesses

It shall be ensured that processes with a different ASIL shall be executed within different user-ids.

Derived from:

Source: score/mw/com/dependability/safety_analysis/aou.trlc:173:14

[OK] TRLC Aou Communication.ConfigOnASafeFilesystem

It shall be ensured that any configuration item that is read at runtime by LoLa is stored on a safety certified filesystem (according to the highest supported safety level).

Derived from:

Source: score/mw/com/dependability/safety_analysis/aou.trlc:188:14

[OK] TRLC Aou Communication.NoStaticContextSupport

It shall be ensured that LoLa is not used within static context within C++.

Derived from:

Source: score/mw/com/dependability/safety_analysis/aou.trlc:204:14

[OK] TRLC Aou Communication.NoGuaranteeInAvailabilityOfServices

It shall be ensured that no safety goal is harmed, because a service instance is not found.

Derived from:

Source: score/mw/com/dependability/safety_analysis/aou.trlc:215:14

[OK] TRLC Aou Communication.CheckForAllocationError

It shall be checked if Allocate() returns an error. If an error is returned, the system shall transition to safe state.

Derived from:

Source: score/mw/com/dependability/safety_analysis/aou.trlc:237:14

[OK] TRLC Aou Communication.OneProducerOnlyOneAllocateePtr

It shall be ensured that at any time a producer instance per event only holds one AllocateePtr.

Derived from:

Source: score/mw/com/dependability/safety_analysis/aou.trlc:258:14

[OK] TRLC Aou Communication.SkeletonAliveWhileItsAllocateePtrBeingUsed

It shall be ensured that a Skeleton instance is still alive while any AllocateePtr returned by it is used.

Derived from:

Source: score/mw/com/dependability/safety_analysis/aou.trlc:297:14

[OK] TRLC Aou Communication.EventSubscriptionActiveWhileHoldingSamplePtr

It shall be ensured that Unsubscribe() isn’t called on a proxy event instance as long as any SamplePtr provided by it, is still held. Also the corresponding proxy instance shall be kept alive as on destruction it would implicitly call Unsubscribe().

Derived from:

Source: score/mw/com/dependability/safety_analysis/aou.trlc:310:14

[OK] TRLC Aou Communication.NoneTerminatingCallbacks

It shall be ensured that any callback passed to LoLa for invocation is not throwing.

Derived from:

Source: score/mw/com/dependability/safety_analysis/aou.trlc:330:14

[OK] TRLC Aou Communication.ValidCallbacksWhileProxyAlive

It shall be ensured that all callbacks passed towards LoLa are valid as long as the associated proxy is alive.

Derived from:

Source: score/mw/com/dependability/safety_analysis/aou.trlc:341:14

[OK] TRLC Aou Communication.QualityOfDataIsDependentOnProducer

It shall be ensured that the necessary quality of data is produced by the respective skeleton process.

Derived from:

Source: score/mw/com/dependability/safety_analysis/aou.trlc:359:14

[OK] TRLC Aou Communication.ValidityOfPointerOnLoLaPointer

It shall be ensured that no pointer, pointing to the memory of a SamplePtr or AllocateePtr is used once the SamplePtr or AllocateePtr are invalid.

Derived from:

Source: score/mw/com/dependability/safety_analysis/aou.trlc:377:14

[OK] TRLC Aou Communication.LoLaMemoryOnlyAccessedThroughLoLa

It shall be ensured that no other code accesses the mapped memory managed by LoLa.

Derived from:

Source: score/mw/com/dependability/safety_analysis/aou.trlc:390:14

[OK] TRLC Aou Communication.NoSharedMemoryAllocationInNamespaceLola

It shall be ensured that no other code creates shared memory segments beginning with “lola”.

Derived from:

Source: score/mw/com/dependability/safety_analysis/aou.trlc:413:14

[OK] TRLC Aou Communication.LoLaSpecificQnxMessagingEndPointsOnlyAccessedThroughLoLa

It shall be ensured that the LoLa specific QNX Message Passing end-points are only accessed through LoLa APIs.

Derived from:

Source: score/mw/com/dependability/safety_analysis/aou.trlc:436:14

[OK] TRLC Aou Communication.ArtifactsRequireManualReview

Input artifacts (C++ service-interface definitions and mw::config) shall be manually reviewed for correctness

Derived from:

Source: score/mw/com/dependability/safety_analysis/aou.trlc:449:14

[OK] TRLC Aou Communication.UnsupportedDataTypes

It shall be ensured that neither variants nor maps are sent via LoLa.

Derived from:

Source: score/mw/com/dependability/safety_analysis/aou.trlc:461:14

[OK] TRLC Aou Communication.NoGuaranteeOnExecutionTime

There is no guarantee on the execution time of any function call provided by LoLa.

Derived from:

Source: score/mw/com/dependability/safety_analysis/aou.trlc:484:14

[OK] TRLC Aou Communication.NoGuaranteesForTimelyMethodCallExecution

It shall be ensured that a blocking method call will not harm a safety goal.

Derived from:

Source: score/mw/com/dependability/safety_analysis/aou.trlc:527:14

[OK] TRLC Aou Communication.MethodInArgPtrMatches

It shall be ensured that the memory locations of the method call in-arguments provided at the caller side are exactly the same as the memory locations as used at the callee side.

Derived from:

Source: score/mw/com/dependability/safety_analysis/aou.trlc:541:14