Launch Manager Requirements
status: valid
security: YES
safety: ASIL_B
version: 1

Note

Requirements which are not planned to be implemented in the version 1.0 of S-CORE are set to status invalid.

Component Launch Manager Requirements#

Components#

Invalid dependency
status: valid
security: NO
safety: ASIL_B
reqtype: Functional
version: 1

The Launch Manager shall reject an inconsistent definition of set of executables dependencies.

Activating Components#

Configuration of component activation timeout
status: valid
security: NO
safety: ASIL_B

The Launch Manager shall support configuring a timeout value that defines the maximum time allowed for a component to reach its Ready State.

Component activation timeout
status: valid
security: NO
safety: ASIL_B
reqtype: Functional
version: 1

If a component does not reach its Ready State within the configured timeout, the Launch Manager shall consider the component activation attempt as failed.

Deactivating Components#

Fast shutdown
status: invalid
security: NO
safety: ASIL_B
reqtype: Functional
version: 1

The Launch Manager shall support fast shutdown by terminating itself without considering the started Processes.

Note

Fast shutdown allows the Launch Manager to terminate its own process normally, without waiting for the started Processes. Use case: This is relevant when the system needs to restart quickly, so it shuts down the launch manager in ordinary manner, but ignores the child processes.

Normal shutdown
status: valid
security: NO
safety: ASIL_B
reqtype: Functional
version: 1

The Launch Manager shall support normal shutdown by terminating all process in the dependency order.

Launch Manager shutdown
status: valid
security: NO
safety: ASIL_B

The Launch Manager shall exit after performing shutdown operation by stopping all the Processes it owns in the dependency order when requested.

Dropping process responsibility
status: invalid
security: NO
safety: ASIL_B
reqtype: Functional
version: 1

The Launch Manager shall provide support to dropping all surveillance and failure reaction activities of Processes.

Note

Use case: When the Launch Manager shuts down, selected Processes can be kept alive to continue their execution without interruption.

Coordination stop dependency
status: invalid
security: NO
safety: ASIL_B
reqtype: Functional
version: 1

The Launch Manager shall permit the stop order of non-dependent processes to be specified.

Dangling dependency
status: valid
security: NO
safety: ASIL_B
reqtype: Functional
version: 1

The Launch Manager shall be able to stop a process when all it’s dependents are stopped if specified in the set of executables.

Conditional Launching#

Configuration of component readiness conditions
status: valid
security: NO
safety: ASIL_B

The Launch Manager shall support configuration of conditions that shall be met before the component is considered to have reached its Ready State.

Dependency based startup order
status: valid
security: NO
safety: ASIL_B

The Launch Manager shall start a component only after all its dependencies have successfully reached their Ready State.

Ready Conditions#

Ready Condition - OS Process State
status: valid
security: NO
safety: ASIL_B

The Launch Manager shall support a Ready Condition that is satisfied when the configured binary is launched.

Ready Condition - File state
status: valid
security: NO
safety: ASIL_B

The Launch Manager shall support a Ready Condition that is satisfied when a configured file path exists or does not exist.

Condition check based on at least one dependency
status: valid
security: NO
safety: ASIL_B
reqtype: Functional
version: 1

The Launch Manager shall provide a method to check if at least one dependency has been executed.

Condition check for each SWC its dependencies
status: valid
security: NO
safety: ASIL_B
reqtype: Functional
version: 1

The Launch Manager shall provide a way to define for each SWC (Software Components), its dependencies.

Processes#

Launching Processes#

Forward process information
status: invalid
security: NO
safety: ASIL_B
reqtype: Functional
version: 1

The Launch Manager shall provide support to pass the output of one or multiple Processes as input arguments to another process.

Note

This is a similar concept to piping in shell scripting, where the output of one process can be used as the input to another.

Multiple instance of executable
status: invalid
security: NO
safety: ASIL_B
reqtype: Functional
version: 1

The Launch Manager shall permit an executable to be launched more than once.

Process Configuration#
Handling process args
status: valid
security: NO
safety: ASIL_B

The Launch Manager shall provide support for launching a process with a given set of arguments.

Process user, group IDs support
status: valid
security: NO
safety: ASIL_B
reqtype: Functional
version: 1

The Launch Manager shall provide support for launching a process with a given UID/GID (user name/Group Identifier).

Process priority support
status: valid
security: NO
safety: ASIL_B
reqtype: Functional
version: 1

The Launch Manager shall provide support for launching a process with a given priority.

CWD support
status: valid
security: NO
safety: ASIL_B
reqtype: Functional
version: 1

The Launch Manager shall provide support for launching a process with a given Working Directory.

Launching terminal
status: valid
security: NO
safety: ASIL_B
reqtype: Functional
version: 1

The Launch Manager shall provide support for launching a terminal or a session leader.

Standard handle redirection
status: valid
security: NO
safety: ASIL_B
reqtype: Functional
version: 1

The Launch Manager shall provide support for stdin, stdout, stderr redirection.

Non-root support
status: valid
security: NO
safety: ASIL_B
reqtype: Functional
version: 1

The Launch Manager shall provide support to be started with security policy as non-root.

Configurable amount of retries on startup
status: valid
security: NO
safety: ASIL_B
reqtype: Functional
version: 1

The Launch Manager shall support a configurable amount of retries in case error occurs during startup of a component (e.g. file not available) occurs.

Process capability support
status: valid
security: NO
safety: ASIL_B
reqtype: Functional
version: 1

The Launch Manager shall provide support for launching Processes with configured OS-specific capabilities and privileges.

File descriptor inheritance support
status: valid
security: NO
safety: ASIL_B
reqtype: Functional
version: 1

The Launch Manager shall provide support for launching a process with given File Descriptor inheritance restrictions.

Security policy support
status: valid
security: YES
safety: ASIL_B
reqtype: Functional
version: 1

The Launch Manager shall provide support for launching a process with a given security policy.

Supplementary group support
status: valid
security: NO
safety: ASIL_B
reqtype: Functional
version: 1

The Launch Manager shall provide support for launching a process with a given set of supplementary groups.

Scheduling support
status: valid
security: NO
safety: ASIL_B
reqtype: Functional
version: 1

The Launch Manager shall provide support for launching a process with certain scheduling policy.

CPU runmask support
status: valid
security: NO
safety: ASIL_B
reqtype: Functional
version: 1

The Launch Manager shall provide support for launching a process with a given runmask.

ASLR support
status: valid
security: YES
safety: ASIL_B
reqtype: Functional
version: 1

The Launch Manager shall provide support for launching process with ASLR (Address Space Layout Randomization).

Resource limit support
status: valid
security: NO
safety: ASIL_B
reqtype: Functional
version: 1

The Launch Manager shall provide support for launching a process with a set of system resource limits (rlimit) which are defined by the POSIX-Standard (IEEE Std 1003.1). I.e. RLIMIT_CORE, RLIMIT_CPU, RLIMIT_DATA, RLIMIT_FSIZE, RLIMIT_NOFILE, RLIMIT_STACK and RLIMIT_AS.

Process detach from parent support
status: invalid
security: NO
safety: ASIL_B
reqtype: Functional
version: 1

The Launch Manager shall provide support for launching a process to detach from parent.

Note

Detaching from the parent process is also known as creating a daemon process. Use case: There might be processes which need to continue running independently of the launch manager.

Launching processes in parallel
status: valid
security: NO
safety: ASIL_B
reqtype: Functional
version: 1

The Launch Manager shall shall provide support for launching Processes in parallel.

Terminating Processes#

Stop timeout
status: valid
security: NO
safety: ASIL_B
reqtype: Functional
version: 1

The Launch Manager shall provide support for configurable timeout Interval to wait for the process to be stopped.

Configurable delay between SIGTERM and SIGKILL
status: valid
security: NO
safety: ASIL_B
reqtype: Functional
version: 1

The Launch Manager shall offer a configuration of the time to wait before SIGKILL is sent. In case “0” is stated, the SIGKILL shall be sent immediately.

Shutdown signal handling
status: valid
security: NO
safety: ASIL_B
reqtype: Functional
version: 1

The Launch Manager shall implement a shutdown by sending a SIGTERM to the process. In case the process does not terminate itself, a SIGKILL shall be sent.

Containers#

Runtime configuration compliance
status: invalid
security: NO
safety: ASIL_B
reqtype: Functional
version: 1

The launch manager shall provide modular configuration files support for configurations coming from OCI runtime configuration<https://github.com/opencontainers/runtime-spec/blob/v1.2.0/config.md>.

Run Targets#

Launching run target
status: valid
security: NO
safety: ASIL_B
reqtype: Functional
version: 1

The Launch Manager shall be able to start a named Run Target.

Run target to component dependencies
status: valid
security: NO
safety: ASIL_B

The Launch Manager shall provide support to define a Run Target dependency to Components.

Run target to run target dependencies
status: valid
security: NO
safety: ASIL_B
reqtype: Functional
version: 1

The Launch Manager shall provide support to define a Run Target dependency to another Run Target.

Configuration of Run Target activation timeout
status: valid
security: NO
safety: ASIL_B

The Launch Manager shall support configuration of the maximum time an activation of a Run Target can take.

Run Target activation timeout
status: valid
security: NO
safety: ASIL_B
reqtype: Functional
version: 1

If the activation of a Run Target exceeds the maximum configured time, then the Launch Manager shall consider this activation as failed.

Process state
status: valid
security: NO
safety: ASIL_B

The Launch Manager shall have a means for the launched Processes to communicate a state, which represents the launched processes’ internal state, to the launcher.

Switch between run targets
status: valid
security: NO
safety: ASIL_B

The Launch Manager shall be able to switch between different run targets.

Alive Monitoring#

Process state notification
status: valid
security: NO
safety: ASIL_B
reqtype: Functional
version: 1

The Launch Manager shall provide support for external monitors to get notified on process life status.

Monitoring and recovery: recovery wait time
status: valid
security: NO
safety: ASIL_B
reqtype: Functional
version: 1

The Launch Manager shall provide support for configurable wait time that shall elapse before repeating Recovery Action.

Monitoring and recovery: adopted process monitoring
status: invalid
security: NO
safety: ASIL_B
reqtype: Functional
version: 1

The Launch Manager shall provide support for monitoring adopted Processes.

Note

An adopted process is a process that was not originally launched by the Launch Manager. Use case: There might be processes which are needed to start very early during bootup and are therefore launched by the system before the Launch Manager takes control.

Component monitoring during startup
status: valid
security: NO
safety: ASIL_B

The Launch Manager shall be able to detect Component failure during startup of the Component. I.e. before reaching its Ready State.

Component monitoring during runtime
status: valid
security: NO
safety: ASIL_B

The Launch Manager shall be able to detect Component failure during runtime of the Component. I.e. after reaching its Ready State.

Recovery Actions#

Recovery by reactivating the component
status: valid
security: NO
safety: ASIL_B
reqtype: Functional
version: 1

The Launch Manager shall be able to react to a Component failure by reactivating the failed Component.

Recovery by switching the Run Target
status: valid
security: NO
safety: ASIL_B

The Launch Manager shall be able to react to a Component failure by switching to another Run Target.

Recovery by stopping the component
status: invalid
security: NO
safety: ASIL_B
reqtype: Functional
version: 1

The Launch Manager shall be able to react to a Component failure by stopping the failed Component.

Recovery by stopping the component and starting another component
status: invalid
security: NO
safety: ASIL_B
reqtype: Functional
version: 1

The Launch Manager shall be able to react to a Component failure by stopping the failed Component and starting another Component instead.

Recovery by stopping the servicing of the watchdog
status: invalid
security: NO
safety: ASIL_B
reqtype: Functional
version: 1

The Launch Manager shall be able to react to a Component failure by stopping the servicing of the Watchdog.

Watchdog#

Launch manager external watchdog notification
status: valid
security: NO
safety: ASIL_B
reqtype: Functional
version: 1

The Launch Manager shall trigger a notification to an external Watchdog for each successful self monitoring test execution.

Launch manager external watchdog notification - failed test
status: valid
security: NO
safety: ASIL_B
reqtype: Functional
version: 1

The Launch Manager shall not trigger an external Watchdog notification if an internal health check failed.

Launch manager external monitoring configuration
status: valid
security: NO
safety: ASIL_B
reqtype: Functional
version: 1

The Launch Manager shall support configuring the Interval of the internal health check executions.

Logging#

Logging slog2 and file support
status: valid
security: NO
safety: ASIL_B
reqtype: Functional
version: 1

The Launch Manager shall support OS specific logging facilities to analyze the early boot sequence.

Logging state transitions
status: valid
security: NO
safety: ASIL_B
reqtype: Functional
version: 1

The Launch Manager shall provide support for logging process launches, Processes exit/recovery, internal tasks, and interaction with external monitor.

Logging timestamp
status: valid
security: NO
safety: ASIL_B
reqtype: Functional
version: 1

The Launch Manager logs shall contain timestamp information.

Logging DAG
status: valid
security: NO
safety: ASIL_B
reqtype: Functional
version: 1

The Launch Manager shall provide the possibility to log the DAG in a human readable format, triggered via Control Interface.

Configuration dependency view
status: invalid
security: NO
safety: QM
reqtype: Functional
version: 1

The Launch Manager shall have the means to log the current dependencies in a format that can be visualized when requested.

Configuration file#

Configuration file support
status: invalid
security: NO
safety: ASIL_B
reqtype: Functional
version: 1

The launch manager shall provide modular configuration file support to configure process attributes.

Global process properties
status: valid
security: NO
safety: ASIL_B
reqtype: Functional
version: 1

The Launch Manager shall be able to centrally define defaults for specific properties for the set of executables.

Lazy check of configured commands
status: valid
security: NO
safety: ASIL_B
reqtype: Functional
version: 1

The Launch Manager shall check availability of executables in the filesystem only when the executable shall required to be executed.

Configuration Verification tool
status: invalid
security: NO
safety: QM
reqtype: Functional
version: 1

The Launch Manager shall have a means to validate the configuration offline.