Launch Manager Requirements
|
status: valid
security: YES
safety: ASIL_B
|
||||
Note
Requirements which are not planned to be implemented in the version 1.0 of S-CORE are set to status invalid.
Component Launch Manager Requirements#
Components#
Invalid dependency
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall reject an inconsistent definition of set of executables dependencies. |
|||||
Activating Components#
Configuration of component activation timeout
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall support configuring a timeout value that defines the maximum time allowed for a component to reach its Ready State. |
|||||
Component activation timeout
|
status: valid
security: NO
safety: ASIL_B
|
||||
If a component does not reach its Ready State within the configured timeout, the Launch Manager shall consider the component activation attempt as failed. |
|||||
Deactivating Components#
Fast shutdown
|
status: invalid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall support fast shutdown by terminating itself without considering the started Processes. Note Fast shutdown allows the Launch Manager to terminate its own process normally, without waiting for the started Processes. Use case: This is relevant when the system needs to restart quickly, so it shuts down the launch manager in ordinary manner, but ignores the child processes. |
|||||
Normal shutdown
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall support normal shutdown by terminating all process in the dependency order. |
|||||
Launch Manager shutdown
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall exit after performing shutdown operation by stopping all the Processes it owns in the dependency order when requested. |
|||||
Dropping process responsibility
|
status: invalid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall provide support to dropping all surveillance and failure reaction activities of Processes. Note Use case: When the Launch Manager shuts down, selected Processes can be kept alive to continue their execution without interruption. |
|||||
Coordination stop dependency
|
status: invalid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall permit the stop order of non-dependent processes to be specified. |
|||||
Dangling dependency
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall be able to stop a process when all it’s dependents are stopped if specified in the set of executables. |
|||||
Conditional Launching#
Configuration of component readiness conditions
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall support configuration of conditions that shall be met before the component is considered to have reached its Ready State. |
|||||
Dependency based startup order
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall start a component only after all its dependencies have successfully reached their Ready State. |
|||||
Ready Conditions#
Ready Condition - OS Process State
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall support a Ready Condition that is satisfied when the configured binary is launched. |
|||||
Ready Condition - Lifecycle Interface
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall support a Ready Condition that is satisfied when Component notifies the Lifecycle Interface. |
|||||
Ready Condition - File state
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall support a Ready Condition that is satisfied when a configured file path exists or does not exist. |
|||||
Condition check based on at least one dependency
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall provide a method to check if at least one dependency has been executed. |
|||||
Condition check for each SWC its dependencies
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall provide a way to define for each SWC (Software Components), its dependencies. |
|||||
Processes#
Launching Processes#
Forward process information
|
status: invalid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall provide support to pass the output of one or multiple Processes as input arguments to another process. Note This is a similar concept to piping in shell scripting, where the output of one process can be used as the input to another. |
|||||
Multiple instance of executable
|
status: invalid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall permit an executable to be launched more than once. |
|||||
Process Configuration#
Handling process args
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall provide support for launching a process with a given set of arguments. |
|||||
Process user, group IDs support
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall provide support for launching a process with a given UID/GID (user name/Group Identifier). |
|||||
Process priority support
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall provide support for launching a process with a given priority. |
|||||
CWD support
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall provide support for launching a process with a given Working Directory. |
|||||
Launching terminal
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall provide support for launching a terminal or a session leader. |
|||||
Standard handle redirection
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall provide support for stdin, stdout, stderr redirection. |
|||||
Non-root support
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall provide support to be started with security policy as non-root. |
|||||
Configurable amount of retries on startup
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall support a configurable amount of retries in case error occurs during startup of a component (e.g. file not available) occurs. |
|||||
Process capability support
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall provide support for launching Processes with configured OS-specific capabilities and privileges. |
|||||
File descriptor inheritance support
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall provide support for launching a process with given File Descriptor inheritance restrictions. |
|||||
Security policy support
|
status: valid
security: YES
safety: ASIL_B
|
||||
The Launch Manager shall provide support for launching a process with a given security policy. |
|||||
Supplementary group support
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall provide support for launching a process with a given set of supplementary groups. |
|||||
Scheduling support
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall provide support for launching a process with certain scheduling policy. |
|||||
CPU runmask support
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall provide support for launching a process with a given runmask. |
|||||
ASLR support
|
status: valid
security: YES
safety: ASIL_B
|
||||
The Launch Manager shall provide support for launching process with ASLR (Address Space Layout Randomization). |
|||||
Resource limit support
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall provide support for launching a process with a set of system resource limits (rlimit) which are defined by the POSIX-Standard (IEEE Std 1003.1). I.e. RLIMIT_CORE, RLIMIT_CPU, RLIMIT_DATA, RLIMIT_FSIZE, RLIMIT_NOFILE, RLIMIT_STACK and RLIMIT_AS. |
|||||
Process detach from parent support
|
status: invalid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall provide support for launching a process to detach from parent. Note Detaching from the parent process is also known as creating a daemon process. Use case: There might be processes which need to continue running independently of the launch manager. |
|||||
Launching processes in parallel
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall shall provide support for launching Processes in parallel. |
|||||
Terminating Processes#
Stop timeout
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall provide support for configurable timeout Interval to wait for the process to be stopped. |
|||||
Configurable delay between SIGTERM and SIGKILL
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall offer a configuration of the time to wait before SIGKILL is sent. In case “0” is stated, the SIGKILL shall be sent immediately. |
|||||
Shutdown signal handling
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall implement a shutdown by sending a SIGTERM to the process. In case the process does not terminate itself, a SIGKILL shall be sent. |
|||||
Containers#
Runtime configuration compliance
|
status: invalid
security: NO
safety: ASIL_B
|
||||
The launch manager shall provide modular configuration files support for configurations coming from OCI runtime configuration<https://github.com/opencontainers/runtime-spec/blob/v1.2.0/config.md>. |
|||||
Run Targets#
Launching run target
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall be able to start a named Run Target. |
|||||
Run target to component dependencies
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall provide support to define a Run Target dependency to Components. |
|||||
Run target to run target dependencies
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall provide support to define a Run Target dependency to another Run Target. |
|||||
Configuration of Run Target activation timeout
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall support configuration of the maximum time an activation of a Run Target can take. |
|||||
Run Target activation timeout
|
status: valid
security: NO
safety: ASIL_B
|
||||
If the activation of a Run Target exceeds the maximum configured time, then the Launch Manager shall consider this activation as failed. |
|||||
Process state
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall have a means for the launched Processes to communicate a state, which represents the launched processes’ internal state, to the launcher. |
|||||
Switch between run targets
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall be able to switch between different run targets. |
|||||
Alive Monitoring#
Process state notification
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall provide support for external monitors to get notified on process life status. |
|||||
Monitoring and recovery: recovery wait time
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall provide support for configurable wait time that shall elapse before repeating Recovery Action. |
|||||
Monitoring and recovery: adopted process monitoring
|
status: invalid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall provide support for monitoring adopted Processes. Note An adopted process is a process that was not originally launched by the Launch Manager. Use case: There might be processes which are needed to start very early during bootup and are therefore launched by the system before the Launch Manager takes control. |
|||||
Component monitoring during startup
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall be able to detect Component failure during startup of the Component. I.e. before reaching its Ready State. |
|||||
Component monitoring during runtime
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall be able to detect Component failure during runtime of the Component. I.e. after reaching its Ready State. |
|||||
Recovery Actions#
Recovery by reactivating the component
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall be able to react to a Component failure by reactivating the failed Component. |
|||||
Recovery by switching the Run Target
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall be able to react to a Component failure by switching to another Run Target. |
|||||
Recovery by stopping the component
|
status: invalid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall be able to react to a Component failure by stopping the failed Component. |
|||||
Recovery by stopping the component and starting another component
|
status: invalid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall be able to react to a Component failure by stopping the failed Component and starting another Component instead. |
|||||
Recovery by stopping the servicing of the watchdog
|
status: invalid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall be able to react to a Component failure by stopping the servicing of the Watchdog. |
|||||
Watchdog#
Launch manager external watchdog notification
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall trigger a notification to an external Watchdog for each successful self monitoring test execution. |
|||||
Launch manager external watchdog notification - failed test
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall not trigger an external Watchdog notification if an internal health check failed. |
|||||
Launch manager external monitoring configuration
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall support configuring the Interval of the internal health check executions. |
|||||
Logging#
Logging slog2 and file support
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall support OS specific logging facilities to analyze the early boot sequence. |
|||||
Logging state transitions
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall provide support for logging process launches, Processes exit/recovery, internal tasks, and interaction with external monitor. |
|||||
Logging timestamp
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager logs shall contain timestamp information. |
|||||
Logging DAG
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall provide the possibility to log the DAG in a human readable format, triggered via Control Interface. |
|||||
Configuration dependency view
|
status: invalid
security: NO
safety: QM
|
||||
The Launch Manager shall have the means to log the current dependencies in a format that can be visualized when requested. |
|||||
Configuration file#
Configuration file support
|
status: invalid
security: NO
safety: ASIL_B
|
||||
The launch manager shall provide modular configuration file support to configure process attributes. |
|||||
Global process properties
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall be able to centrally define defaults for specific properties for the set of executables. |
|||||
Lazy check of configured commands
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall check availability of executables in the filesystem only when the executable shall required to be executed. |
|||||
Configuration Verification tool
|
status: invalid
security: NO
safety: QM
|
||||
The Launch Manager shall have a means to validate the configuration offline. |
|||||