mw_com_fmea#
Overview#
Failure Mode |
Guideword |
ASIL |
Interface |
|---|---|---|---|
B |
|||
B |
mw.com.Runtime.Initialize |
||
B |
|||
B |
|||
B |
|||
B |
mw.com.Skeleton.Create |
||
B |
mw.com.Skeleton.OfferService |
||
B |
mw.com.Skeleton.OfferService |
||
B |
mw.com.Skeleton.OfferService |
||
B |
mw.com.Skeleton.OfferService |
||
B |
mw.com.Skeleton.OfferService |
||
B |
mw.com.Skeleton.OfferService |
||
B |
|||
B |
mw.com.Skeleton.StopOfferService |
||
B |
|||
B |
mw.com.Skeleton.StopOfferService |
||
B |
|||
B |
mw.com.Event.Allocate |
||
B |
|||
B |
|||
B |
|||
B |
mw.com.Event.Send |
||
B |
|||
B |
mw.com.Event.Send |
||
B |
mw.com.Event.Send |
||
B |
|||
B |
mw.com.Event.Send |
||
B |
mw.com.Skeleton.Destroy |
||
B |
mw.com.Skeleton.Destroy |
||
B |
|||
B |
|||
B |
|||
B |
|||
B |
mw.com.Proxy.StartFindService |
||
B |
mw.com.Proxy.FindService |
||
B |
mw.com.Proxy.FindService |
||
B |
mw.com.Proxy.FindService |
||
B |
|||
B |
|||
B |
|||
B |
|||
B |
|||
B |
|||
B |
|||
B |
|||
B |
|||
B |
|||
B |
|||
B |
|||
B |
|||
B |
mw.com.Event.GetNewSamples |
||
B |
|||
B |
|||
B |
|||
B |
|||
B |
|||
B |
|||
B |
mw.com.GenericProxyEvent.GetSampleSize |
||
B |
mw.com.GenericProxyEvent.GetSampleSize |
||
B |
mw.com.GenericProxyEvent.HasSerializedFormat |
||
B |
|||
B |
|||
B |
|||
B |
|||
B |
|||
B |
|||
B |
|||
B |
|||
B |
|||
B |
Failure Modes#
Communication.InMemoryConfigurationWrong
ASIL B
mw.com.Runtime.Initialize
Other functionality relies on a correct configuration. Without that, multiple functions can not operate normally which could lead to the violation of a safety goal.
The in-memory (cpp representation) does not match the on file-system JSON configuration.
Root Cause Analysis
Communication.MethodCallBlocksLongerThanExpected
ASIL B
This could cause a halt of parts of/or the whole system.
A call to a service-method on the client/consumer side blocks longer than expected (or indefinite). This is a specific instance of FailureMode [AnyFunctionBlocksLongerThanExpected], but since with service-methods we have concrete root causes in the form of message-passing behaviour and behaviour of user-provided handler, we have this specific failure mode.
Root Cause Analysis
Communication.WrongMethodInArgsProvided
ASIL B
Communication of data-garbage, which could harm an overall safety goal.
Unintended input arguments are provided to a service method call. Therefore, the method call gets executed with wrong input data.
Root Cause Analysis
Communication.WrongReturnValueUsed
ASIL B
Communication of data-garbage, which could harm an overall safety goal.
Unintended results are provided from a service method call. Therefore, the caller of the method works on wrong data.
Root Cause Analysis
Communication.ServiceIsFoundButDoesNotExist
ASIL B
mw.com.Proxy.FindService
No communication between process will happen, thus no information can be exchanged, thus any overall system functionality can stop.
Finding a service, returns a service, even though no service instance was offered.
Root Cause Analysis
Communication.ServiceNotFound
ASIL B
mw.com.Proxy.FindService
No communication between process will happen, thus no information can be exchanged, thus any overall system functionality can stop.
A proxy does not find a service instance, even though it was offered by a skeleton.
Root Cause Analysis
Communication.WrongServiceFound
ASIL B
mw.com.Proxy.FindService
The actual intended communication will not happen, thus potential causing a complete loss of system functionality. In the worst case, the wrong identifiers are used by another service. In that case a wrong consumer could think that he found the right service, leading to a case where garbage data is transmitted, causing any potential issues in the whole system functionality (e.g. violating the top level safety goal).
A proxy instance finds a wrong service. This could be either a wrong service instance or a completely wrong service.
Root Cause Analysis
Communication.TheSizeReturnedIsBiggerThenTheActualValue
ASIL B
mw.com.GenericProxyEvent.GetSampleSize
Undefined behavior due to wrong memory access.
The user receives a size, that is bigger then the actual value.
Root Cause Analysis
Communication.MapContainingNonexistentEvents
ASIL B
A user could take wrong actions based on this information and thus affect any safety goal.
The map that is visible to the user, contains events that are not actually existing (e.g. in the configuration).
Root Cause Analysis
Communication.CallbackInvokedWithWrongData
ASIL B
processing of invalid data can cause any safety violation (e.g. violation of the top level safety goal)
A proxy receives a sample pointer via callback F(), but the data does not contain the expected one.
Root Cause Analysis
Communication.CallbackNotInvokedDespiteSamplesAvailable
ASIL B
data is not received, causing any possible safety goal violation.
GetNewSamples() gets called on an event with a callback F, but the callback gets called not at all, although at least one new sample is available.
Root Cause Analysis
Communication.StartFindServiceCallbackCalledUnexpectedly
ASIL B
mw.com.Proxy.StartFindService
In the worst case, the callback is invoked all the time, which could lead to: The user thinks that a new proxy is found and creates a proxy with an already used handle; A DDoS is performed, where one thread is constantly blocked. Both can lead to violations of safety goals.
The user-provided callback is invoked, even though it should not be invoked.
Root Cause Analysis
Communication.SubscribeToWrongEvent
ASIL B
It is possible to allocate resources on another event and therefor block another valid subscription to this event. This could cause in the worst case that an safety relevant event cannot receive data, thus harming overall safety goals. Another case is that garbage data is transmitted / received. Causing any possible side-effect.
A service proxy subscribes to a wrong event. This either means that this event does not exist at all, is offered by another service instance, another event in the current instance or a completely different service.
Root Cause Analysis
Communication.SubscribeWithWrongMaxSampleCount
ASIL B
We have two possible effects: First if the number is lower then expected data of the user might be lost unexpectedly. Causing any possible side-effects. If its bigger, we could blocker other receiver which then get to few resources. Or the subscription fails at all. In the first two cases a possible safety goal violation could happen by not transmitting safety relevant data reliably.
A proxy instance subscribes to an event to with a wrong sample count, meaning a different one that was provided by the user.
Root Cause Analysis
Communication.DoesNotUnsubscribe
ASIL B
Resource blockage on new subscriptions on other consumers. Maybe no communication possible.
A proxy is subscribed to an event, tries to unsubscribe, but silently fails to unsubscribe.
Root Cause Analysis
Communication.MemoryAllocatedInWrongSection
ASIL B
This could cause transmitting garbage data between processes, causing a complete outage of the system. In the worst case the safety goal could be violated.
The memory for an event is allocated in the wrong memory section (e.g. in Heap, another Shared Memory segment or the stack).
Root Cause Analysis
Communication.TooFewMemoryAllocated
ASIL B
mw.com.Event.Allocate
This could cause transmitting garbage data between processes, causing a complete outage of the system. In the worst case the safety goal could be violated.
The event allocation allocates too few memory (including no memory at all).
Root Cause Analysis
Communication.CreationOfSkeletonNotPossible
ASIL B
mw.com.Skeleton.Create
No communication possible.
It is not possible to create a skeleton instance
Root Cause Analysis
Communication.NoResourcesFreed
ASIL B
mw.com.Skeleton.Destroy
Can cause an overall resource exhaustion.
The resources allocated on construction and during operation are not freed on destruction.
Root Cause Analysis
Communication.WrongResourcesFreed
ASIL B
mw.com.Skeleton.Destroy
This could cause transmitting garbage data between processes, causing a complete outage of the system. In the worst case the safety goal could be violated.
A destruction of one skeleton instances, frees the resources of another skeleton instance.
Root Cause Analysis
Communication.WrongMethodInArgsUsed
ASIL B
Communication of data-garbage, which could harm an overall safety goal.
Unintended input arguments are used in a service method call. Therefore, the method call gets executed with wrong input data.
Root Cause Analysis
Communication.WrongMethodCalled
ASIL B
Communication of data-garbage, which could harm an overall safety goal.
Either the wrong user provided method handler is called or no user handler is called at all. Therefore, the method call results are invalid/garbage.
Root Cause Analysis
Communication.WrongResultsProvided
ASIL B
Communication of data-garbage, which could harm an overall safety goal.
The result of a method call is either not provided in the expected location, leaving uninitialized data in the expected location or it is provided in an inconsistent state. Therefore, the method call results are invalid/garbage.
Root Cause Analysis
Communication.OffersAlreadyOfferedService
ASIL B
mw.com.Skeleton.OfferService
Already existing communication could break up. Or data could be overwritten while transmitted. In any case this could cause potential garbage data, which could cause a complete malfunction of the system.
A skeleton offers a service that was already offered. Either by another process or by itself.
Root Cause Analysis
Communication.ServiceOnlyPartiallyOffered
ASIL B
mw.com.Skeleton.OfferService
This is equal to the case service not offered, thus no information can be exchanged, thus any overall system functionality can stop.
A skeleton offers a service, which is not visible to all consumers, but only to parts of them.
Root Cause Analysis
Communication.ServiceOfferedUnderWrongIds
ASIL B
mw.com.Skeleton.OfferService
The actual intended communication will not happen, thus potential causing a complete loss of system functionality. In the worst case, the wrong identifiers are used by another service. In that case a wrong consumer could think that he found the right service, leading to a case where garbage data is transmitted, causing any potential issues in the whole system functionality (e.g. violating the top level safety goal).
A skeleton is offering a service with wrong identifiers. This can include a service id, a instance id or also the service version.
Root Cause Analysis
Communication.ServiceNotOffered
ASIL B
mw.com.Skeleton.OfferService
No communication between process will happen, thus no information can be exchanged, thus any overall system functionality can stop.
A skeleton service is offering a service, but the service is silently not offered. Note: offered in this case means, that it is also connectable
Root Cause Analysis
Communication.ServiceOfferedWithoutInitialFieldValue
ASIL B
mw.com.Skeleton.OfferService
A user expects after seeing a service offered, in a call to GetNewSamples(), that he would at least get one new sample. This could hinder the expected semantics on user side, and thus affect any safety goal.
A service is offered, although at least one of its field has no initial value set by the provider.
Root Cause Analysis
Communication.ServiceOfferedOnWrongBinding
ASIL B
mw.com.Skeleton.OfferService
No communication between processes will happen, thus, no information can be exchanged, thus, any overall system functionality can malfunction. The point that a service is offered on another binding should not have any effect, since no consumer will expect the service on this binding.
A skeleton is offering a service on the wrong binding. Meaning, the service is not offered on the intended binding, but on an unintended one.
Root Cause Analysis
Communication.SendingEventChangesUserData
ASIL B
mw.com.Event.Send
This could cause transmitting garbage data between processes, causing a complete outage of the system. In the worst case the safety goal could be violated.
A call to send manipulates the data that was provided by the caller.
Root Cause Analysis
Communication.SendingEventDoesNotFreeResources
ASIL B
mw.com.Event.Send
This could lead to a resource exhaustion of the system. Leading to a situation where no communication would be possible.
Resources in the middleware that have been allocated with a previous allocation, are not freed after returning from send/update.
Root Cause Analysis
Communication.SendingEventOnlyPartiallyNotifiesConsumer
ASIL B
mw.com.Event.Send
This could cause that data is not processed, causing a complete outage of the system. In the worst case the safety goal could be violated.
When data is sent, consumers that have a callback registered, are only partially notified.
Root Cause Analysis
Communication.SendingEventSendsToWrongConsumer
ASIL B
mw.com.Event.Send
This could cause transmitting garbage data between processes, causing a complete outage of the system. In the worst case the safety goal could be violated.
An event or field is sent to the wrong consumer.
Root Cause Analysis
Communication.ServiceOnlyPartiallyStopOffered
ASIL B
mw.com.Skeleton.StopOfferService
A service is found by a consumer, even though it shall no longer be found. This shall have no bad influence, since then no data will be send.
A skeleton stop offers a service, but the service is still seen a partial set of consumers.
Root Cause Analysis
Communication.ServiceStopOfferingWrongIds
ASIL B
mw.com.Skeleton.StopOfferService
A wrong service is stop offered. This means that another service might no longer be found, even though it should be found. It could also cause garbage data, depending on the service discovery mechanism. This could cause a complete loss of functionality and influence customer functions
A skeleton is stop offering a service under wrong IDs. This can include a service id, a instance id or also the service version.
Root Cause Analysis
Communication.MethodSignatureElementPtrFailsToFree
ASIL B
Failing to free resources can lead to a loss of function as no further method calls could be processed. This does not harm a safety goal. But freeing the wrong resources could lead to This could harm any safety goal.
On destruction of a MethodSignatureElementPtr wrong memory is freed or not freed at all.
Root Cause Analysis
Communication.MethodSignatureElementPtrWrongTarget
ASIL B
Resolution of the smart pointer to the wrong memory location, leads to garbage data access. This could harm any safety goal.
On de-referencing of a MethodSignatureElementPtr wrong data is returned.
Root Cause Analysis
Communication.DoesNotFreeResourcesOnDestruction
ASIL B
Resource exhaustion. Could block further communication which could lead to failures on provider and consumer side, which on the other hand could lead to a violation of a safety goal.
A SampleAllocateePtr or SamplePtr is destroyed, which should lead to a freeing of resources, but caused by a fault they are not freed.
Root Cause Analysis
Communication.ReturnsWrongData
ASIL B
If you cannot trust the data in the smart pointer, then the data can be garbage, which could break safe communication, which could harm any safety goal.
On dereferenciation of a SamplePtr or SampleAllocateePtr wrong data is returned.
Root Cause Analysis
Communication.AnyFunctionBlocksLongerThanExpected
ASIL B
This could cause a hold of parts or the whole system.
Any API of mw::com (LoLa) blocks longer than expected (or indefinite)
Communication.FunctionCalledFromMultipleThreads
ASIL B
This can lead to race-conditions which can cause data-corruption or data-loss, which could lead to a violation of any safety goal.
Any API is called within multiple threads concurrently without any further synchronization.
Communication.GeneratedCodeDoesNotMatchGenerationInputs
ASIL B
A faulty configuration which does not lead to compile issues could lead to safety issues according to analysis.
Proxys and Skeletons as data-types are generated using the aragen and not handwritten, may not match to the input (Meta-Model).
Communication.MisusedApis
ASIL B
Calling non-public APIs or calling them in the wrong context can lead to un-predictable side-effects. This could cause in the worst case transmitting garbage data, which could cause a violation of any safety goal.
APIs are invoked in either an invalid context or non public APIs are invoked.
Communication.ServiceOfferingNotStopped
ASIL B
A service is found by a consumer, even though it shall no longer be found. This shall have no bad influence, since then no data will be send.
A skeleton offered a service, but the stop offering did not work.
Communication.ServiceStopOfferedOnWrongBinding
ASIL B
A service is found by a consumer, even though it shall no longer be found. This shall have no bad influence, since then no data will be send. On the other (wrong) binding, no effect will happen, since the service was never offered here anyhow.
A skeleton is stop offering a service on the wrong binding. Meaning, the service is still offered on the actual binding.
Communication.WronglyAlignedMemoryAllocated
ASIL B
This could cause transmitting garbage data between processes, causing a complete outage of the system. In the worst case the safety goal could be violated.
The memory for an event/field is allocated in a wrongly aligned manner.
Communication.TooMuchMemoryAllocated
ASIL B
While to much memory has no immediate bad effect, this could cause an overall resource exhaustion within the system.
There is too much memory allocated for one event/field
Communication.AllocatesAlreadyAllocatedMemory
ASIL B
This could cause transmitting garbage data between processes, causing a complete outage of the system. In the worst case the safety goal could be violated.
The memory for an event/field is allocated from already allocated memory (not free memory).
Communication.SendingAnEventOrFieldSendsDataOnlyPartially
ASIL B
This could cause transmitting garbage data between processes, causing a complete outage of the system. In the worst case the safety goal could be violated.
Data that is send by the user, only reaches partially the consumer. This can happen in two ways, only a partial number of consumers see the data or all consumers see only partial data.
Communication.SendingAnEventOrFieldSendsSameSampleNtimes
ASIL B
This could cause transmitting garbage data between processes, causing a complete outage of the system. In the worst case the safety goal could be violated.
Instead of sending a sample (one data point) only once, it is send multiple times.
Communication.EarlyCleanUp
ASIL B
This could cause transmitting garbage data between processes, causing a complete outage of the system. In the worst case the safety goal could be violated.
Resources are freed while still being used.
Communication.StartedFindServiceIsNotStopped
ASIL B
StartFindService handler will be called, even though it is expected that it is not called.
A user called “StartFindService” with a given handler, and since “StopFindService” does not work, services can still be found.
Communication.WrongStartfindserviceIsStopped
ASIL B
That services are not found, even though they are offered and that services are no longer offered.
The handle provided to StopFindService, is identified as another one and thus stops the wrong service discovery query.
Communication.DoesNotSubscribe
ASIL B
A proxy will not be notified over new data. - This will lead to subscription state not changing to subscribed. And therefor a client application will not be able to access samples. This will lead to not receiving any safety relevant information, causing any possible safety goal violation. - Necessary resources might be blocked even though they are not reserved, causing potential blocks of other subscribers.
A proxy does not subscribe to a skeleton. Thus, a skeleton does not know that a proxy is interested in data.
Communication.ReceiveHandlerNotInvoked
ASIL B
It is possible that no event data is received ever and thus any safety issues are possible.
A proxy has set a receive handler and a skeleton is updating an event, but the receive handler is never invoked.
Communication.ReceiveHandlerInvokedWithWrongEvent
ASIL B
The only implication that this has are resource wise on timing. So a always notified handler could block one thread and thus make the overall system way more slow. The safety concept of the whole system supervises timely violations and ensures that no safety goal is harmed.
A receive handler registered for an event, gets called because of an update of an different event.
Communication.ReceiveHandlerInvokedMultipleTimes
ASIL B
The only implication that this has are ressource wise on timing. So a always notified handler could block one thread and thus make the overall system way more slow. The safety concept of the whole system supervises timely violations and ensures that no safety goal is harmed.
A receive handler is invoked multiple times, even though only one event update happend.
Communication.ReceiveHandlerInvokedWithoutEventNotification
ASIL B
A receive handler is invoked, even though no new events are available. The only implication that this has are ressource wise on timing. So a always notified handler could block one thread and thus make the overall system way more slow.
A receive handler is invoked, even though no event update happend.
Communication.UsesToManySampleptr
ASIL B
Synchronization algorithm can no longer hold guarantees, which can cause an exceeding of resources. In worst case another proxy might fail to get updated samples (messages lost without full queues aka not detectable).
User is already max. sample count SamplePtr, but we are still handing out SamplePtrs in callback F().
Communication.ReturnsWrongSampleCount
ASIL B
Potential Data loss with unknown effect on safety goals.
Value returned by GetNewSample() does not match with the number of calls to callback F().
Communication.SucceedsDespiteAnError
ASIL B
mw.com.Event.GetNewSamples
Receive a sample count instead of an error, implies that the sample count is wrong. Receiving an error instead of a sample count, implies that the sample count is wrong.
A user calls GetNewSamples() on a proxy instance and receives a sample count, even though he should have received an error.
Communication.ReturnsWrongFreeSampleCount
ASIL B
It would be no longer possible to detect message losses on full queues.
A user has already M SamplePtr in use from a max. announced number N, but GetFreeSampleCount() returns a different value than N-M.
Communication.UnsubscribesFromWrongEvent
ASIL B
Same as Failuremode SubscribeToWrongEvent
A user unsubscribes from an event, but the unsubscribe is silently carried out on another event.
Communication.DoesNotImplicitRemoveReceiveHandler
ASIL B
Invocation of invalid receive handler, because it no longer exists. This could have any bad potential side effects.
A proxy has registered a receive handler and unsubscribes, this should lead to the case that a receive handler is no longer called. In this failure mode, the receive handler would still be called.
Communication.IncompleteMapOfEvents
ASIL B
Due to the map not complete, this will lead to missed data, because the user is not aware that these events are actually there. This could affect any safety goal.
The user gets presented not all events the generic proxy supports.
Communication.TheSizeReturnedIsSmallerThenTheActualSize
ASIL B
mw.com.GenericProxyEvent.GetSampleSize
Only seeing a subset of the data, thus a potential violation of any safety goal.
The user receives a size, that is smaller then the actual value.
Communication.WrongIndicationIfFormatIsSerialized
ASIL B
mw.com.GenericProxyEvent.HasSerializedFormat
Missinterpretation of data, can lead to any safety violation.
A user, using HasSerializedFormat(), receives the wrong value.
Communication.FreesWrongResources
ASIL B
Communication of data-garbage or resource exhaustion, which both could harm an overall safety goal.
A SampleAllocateePtr or SamplePtr free the wrong resources associated with them.
Communication.DoesNotReserveResources
ASIL B
Data is manipulated from different processes because they think its not owned. Which could cause garbage data and thus harm any safety goal.
A SamplePtr or SampleAllocateePtr do not increase their respective ref-counts and thus avoid data changes.
Communication.DoesNotUpdateFreeSampleCountCorrectly
ASIL B
Users may not know, if they are allowed to retrieve new Samples at all and may therefore fail to get new data! This may violate any safety goal.
When a SamplePtr gets created or destroyed for a given event instance, the Free Sample Count of this instance doesn’t get updated accordingly