Launch Manager Requirements
status: valid
security: YES
safety: ASIL_B
tags: lifecycle, launch_manager
version: 1

Note

Requirements that are not planned for score release 1.0 are set as invalid and have the tag not_planned. Requirements that need further clarification are set as invalid and have the tag unclear.

Component Launch Manager Requirements#

Components#

Note

TODO all requirements that are not under the Process heading shall be reworded to speak in terms of components.

Invalid dependency
status: valid
security: NO
safety: ASIL_B
tags: lifecycle, launch_manager
reqtype: Functional
version: 1

The Launch Manager shall reject an inconsistent definition of set of executables dependencies.

Activating Components#

Component activation timeout
status: valid
security: NO
safety: ASIL_B
tags: lifecycle, launch_manager
reqtype: Functional
version: 1

The Launch Manager shall consider the component activation attempt as failed if a component does not reach its Ready State within the configured timeout in deployment_config.ready_timeout_ms.

Deactivating Components#

Fast shutdown
status: invalid
security: NO
safety: ASIL_B
tags: not_planned, lifecycle, launch_manager
reqtype: Functional
version: 1

The Launch Manager shall support fast shutdown by terminating itself without considering the started Processes.

Note

Fast shutdown allows the Launch Manager to terminate its own process normally, without waiting for the started Processes. Use case: This is relevant when the system needs to restart quickly, so it shuts down the launch manager in ordinary manner, but ignores the child processes.

Normal shutdown
status: valid
security: NO
safety: ASIL_B
tags: lifecycle, launch_manager
reqtype: Functional
version: 1

The Launch Manager shall support normal shutdown by terminating all process in the dependency order.

Launch Manager shutdown
status: valid
security: NO
safety: ASIL_B
tags: lifecycle, launch_manager
reqtype: Functional
version: 1

The Launch Manager shall exit after performing shutdown operation by stopping all the Processes it owns in the dependency order when requested.

Dropping process responsibility
status: invalid
security: NO
safety: ASIL_B
tags: not_planned, lifecycle, launch_manager
reqtype: Functional
version: 1

The Launch Manager shall provide support to dropping all surveillance and failure reaction activities of Processes.

Note

Use case: When the Launch Manager shuts down, selected Processes can be kept alive to continue their execution without interruption.

Coordination stop dependency
status: invalid
security: NO
safety: ASIL_B
tags: unclear, lifecycle, launch_manager
reqtype: Functional
version: 1

The Launch Manager shall permit the stop order of non-dependent processes to be specified.

Dangling dependency
status: valid
security: NO
safety: ASIL_B
tags: lifecycle, launch_manager
reqtype: Functional
version: 1

The Launch Manager shall be able to stop a process when all it’s dependents are stopped if specified in the set of executables.

Conditional Launching#

Configuration of component readiness conditions
status: valid
security: NO
safety: ASIL_B
tags: lifecycle, launch_manager
reqtype: Functional
version: 1

The Launch Manager shall support configuration of conditions that shall be met before the component is considered to have reached its Ready State.

Dependency based startup order
status: valid
security: NO
safety: ASIL_B
tags: lifecycle, launch_manager
reqtype: Functional
version: 1

The Launch Manager shall start a component only after all its dependencies have successfully reached their Ready State.

Ready Conditions#

Ready Condition - OS Process State
status: valid
security: NO
safety: ASIL_B

The Launch Manager shall support a Ready Condition that is satisfied when the configured binary is launched.

Ready Condition - Lifecycle Interface
status: valid
security: NO
safety: ASIL_B

The Launch Manager shall support a Ready Condition that is satisfied when Component notifies the Lifecycle Interface.

Ready Condition - File state
status: valid
security: NO
safety: ASIL_B
tags: lifecycle, launch_manager
reqtype: Functional
version: 1

The Launch Manager shall support a Ready Condition that is satisfied when a configured file path exists or does not exist.

Condition check based on at least one dependency
status: valid
security: NO
safety: ASIL_B
tags: lifecycle, launch_manager
reqtype: Functional
version: 1

The Launch Manager shall provide a method to check if at least one dependency has been executed.

Condition check for each SWC its dependencies
status: valid
security: NO
safety: ASIL_B
tags: lifecycle, launch_manager
reqtype: Functional
version: 1

The Launch Manager shall provide a way to define for each SWC (Software Components), its dependencies.

Processes#

Launching Processes#

Forward process information
status: invalid
security: NO
safety: ASIL_B
tags: not_planned, lifecycle, launch_manager
reqtype: Functional
version: 1

The Launch Manager shall provide support to pass the output of one or multiple Processes as input arguments to another process.

Note

This is a similar concept to piping in shell scripting, where the output of one process can be used as the input to another.

Multiple instance of executable
status: invalid
security: NO
safety: ASIL_B
tags: unclear, lifecycle, launch_manager
reqtype: Functional
version: 1

The Launch Manager shall permit an executable to be launched more than once.

Process Configuration#
Handling process args
status: valid
security: NO
safety: ASIL_B

The Launch Manager shall provide support for launching a process with a given set of arguments.

Process user, group IDs support
status: valid
security: NO
safety: ASIL_B
tags: lifecycle, launch_manager
reqtype: Functional
version: 1

The Launch Manager shall provide support for launching a process with a given UID/GID (user name/Group Identifier).

Process priority support
status: valid
security: NO
safety: ASIL_B
tags: lifecycle, launch_manager
reqtype: Functional
version: 1

The Launch Manager shall provide support for launching a process with a given priority.

CWD support
status: valid
security: NO
safety: ASIL_B
tags: lifecycle, launch_manager
reqtype: Functional
version: 1

The Launch Manager shall provide support for launching a process with a given Working Directory.

Launching terminal
status: valid
security: NO
safety: ASIL_B
tags: lifecycle, launch_manager
reqtype: Functional
version: 1

The Launch Manager shall provide support for launching a terminal or a session leader.

Standard handle redirection
status: valid
security: NO
safety: ASIL_B
tags: lifecycle, launch_manager
reqtype: Functional
version: 1

The Launch Manager shall provide support for stdin, stdout, stderr redirection.

Non-root support
status: valid
security: NO
safety: ASIL_B
tags: lifecycle, launch_manager
reqtype: Functional
version: 1

The Launch Manager shall provide support to be started with security policy as non-root.

Configurable amount of retries on startup
status: valid
security: NO
safety: ASIL_B
tags: lifecycle, launch_manager
reqtype: Functional
version: 1

The Launch Manager shall support restarting the process a configurable amount of times, if the process fails to reach its Ready State. If no retry attempts are successful this shall be considered an Component Failure.

Process capability support
status: valid
security: NO
safety: ASIL_B
tags: lifecycle, launch_manager
reqtype: Functional
version: 1

The Launch Manager shall provide support for launching Processes with configured OS-specific capabilities and privileges.

File descriptor inheritance support
status: valid
security: NO
safety: ASIL_B
tags: lifecycle, launch_manager
reqtype: Functional
version: 1

The Launch Manager shall provide support for launching a process with given File Descriptor inheritance restrictions.

Security policy support
status: valid
security: YES
safety: ASIL_B
tags: lifecycle, launch_manager
reqtype: Functional
version: 1

The Launch Manager shall provide support for launching a process with a given security policy.

Supplementary group support
status: valid
security: NO
safety: ASIL_B
tags: lifecycle, launch_manager
reqtype: Functional
version: 1

The Launch Manager shall provide support for launching a process with a given set of supplementary groups.

Scheduling support
status: valid
security: NO
safety: ASIL_B
tags: lifecycle, launch_manager
reqtype: Functional
version: 1

The Launch Manager shall provide support for launching a process with certain scheduling policy.

CPU runmask support
status: valid
security: NO
safety: ASIL_B
tags: lifecycle, launch_manager
reqtype: Functional
version: 1

The Launch Manager shall provide support for launching a process with a given runmask.

ASLR support
status: valid
security: YES
safety: ASIL_B
tags: lifecycle, launch_manager
reqtype: Functional
version: 1

The Launch Manager shall provide support for launching process with ASLR (Address Space Layout Randomization).

Resource limit support
status: valid
security: NO
safety: ASIL_B
tags: lifecycle, launch_manager
reqtype: Functional
version: 1

The Launch Manager shall provide support for launching a process with a set of system resource limits (rlimit) which are defined by the POSIX-Standard (IEEE Std 1003.1). I.e. RLIMIT_CORE, RLIMIT_CPU, RLIMIT_DATA, RLIMIT_FSIZE, RLIMIT_NOFILE, RLIMIT_STACK and RLIMIT_AS.

Process detach from parent support
status: invalid
security: NO
safety: ASIL_B
tags: not_planned, lifecycle, launch_manager
reqtype: Functional
version: 1

The Launch Manager shall provide support for launching a process to detach from parent.

Note

Detaching from the parent process is also known as creating a daemon process. Use case: There might be processes which need to continue running independently of the launch manager.

Launching processes in parallel
status: valid
security: NO
safety: ASIL_B
tags: lifecycle, launch_manager
reqtype: Functional
version: 1

The Launch Manager shall provide support for launching Processes in parallel.

Terminating Processes#

Stop timeout
status: valid
security: NO
safety: ASIL_B
tags: lifecycle, launch_manager
reqtype: Functional
version: 1

The Launch Manager shall provide support for configurable timeout Interval to wait for the process to be stopped.

Configurable delay between SIGTERM and SIGKILL
status: valid
security: NO
safety: ASIL_B
tags: lifecycle, launch_manager
reqtype: Functional
version: 1

The Launch Manager shall offer a configuration of the time to wait before SIGKILL is sent. In case “0” is stated, the SIGKILL shall be sent immediately.

Shutdown signal handling
status: valid
security: NO
safety: ASIL_B
tags: lifecycle, launch_manager
reqtype: Functional
version: 1

The Launch Manager shall implement a shutdown by sending a SIGTERM to the process. In case the process does not terminate itself, a SIGKILL shall be sent.

Containers#

Runtime configuration compliance
status: invalid
security: NO
safety: ASIL_B
tags: not_planned, lifecycle, launch_manager
reqtype: Functional
version: 1

The launch manager shall provide modular configuration files support for configurations coming from OCI runtime configuration<https://github.com/opencontainers/runtime-spec/blob/v1.2.0/config.md>.

Run Targets#

Launching run target
status: valid
security: NO
safety: ASIL_B
tags: lifecycle, launch_manager
reqtype: Functional
version: 1

The Launch Manager shall be able to start a named Run Target.

Run target to component dependencies
status: valid
security: NO
safety: ASIL_B

The Launch Manager shall provide support to define a Run Target dependency to Components.

Run target to run target dependencies
status: valid
security: NO
safety: ASIL_B
tags: lifecycle, launch_manager
reqtype: Functional
version: 1

The Launch Manager shall provide support to define a Run Target dependency to another Run Target.

Run Target activation timeout
status: valid
security: NO
safety: ASIL_B
tags: lifecycle, launch_manager
reqtype: Functional
version: 1

The Launch Manager shall consider a Run Target activation as failed if the activation exceed the time configured in run_target.transition_timeout_ms.

Process state
status: valid
security: NO
safety: ASIL_B
tags: lifecycle, launch_manager
reqtype: Functional
version: 1

The Launch Manager shall have a means for the launched Processes to communicate a state, which represents the launched processes’ internal state, to the launcher.

Switch between run targets
status: valid
security: NO
safety: ASIL_B
tags: lifecycle, launch_manager
reqtype: Functional
version: 1

The Launch Manager shall be able to switch between different run targets.

Alive Monitoring#

Alive monitoring failure
status: valid
security: NO
safety: ASIL_B
tags: lifecycle, launch_manager
reqtype: Functional
version: 1

The Launch Manager shall forcefully deactivate a Component when an alive supervision failure is detected for it, without notifying the Component and without allowing it to perform any cleanup. This is then considered as a Component Failure.

Component monitoring during startup
status: valid
security: NO
safety: ASIL_B

The Launch Manager shall be able to detect Component failure throughout the whole lifetime of a Component.

Monitoring and recovery: adopted process monitoring
status: invalid
security: NO
safety: ASIL_B
tags: not_planned, lifecycle, launch_manager
reqtype: Functional
version: 1

The Launch Manager shall provide support for monitoring adopted Processes.

Note

An adopted process is a process that was not originally launched by the Launch Manager. Use case: There might be processes which are needed to start very early during bootup and are therefore launched by the system before the Launch Manager takes control.

Recovery Actions#

Component failure during run target switch
status: valid
security: NO
safety: ASIL_B
tags: lifecycle, launch_manager
reqtype: Functional
version: 1

The Launch Manager shall perform the Run Target recovery action when a Component Failure is detected and there is an ongoing Run Target transition.

Component recovery action failure escalation
status: valid
security: NO
safety: ASIL_B
tags: lifecycle, launch_manager
reqtype: Functional
version: 1

The Launch Manager shall perform the Run Target recovery action if a Component recovery action has failed or is not configured.

Recovery Action
status: valid
security: NO
safety: ASIL_B
tags: lifecycle, launch_manager
reqtype: Functional
version: 1

The Launch Manager shall cancel all pending and ongoing Run Target activations before running any Run Target recovery action.

Recovery state manager notification
status: valid
security: NO
safety: ASIL_B
tags: lifecycle, launch_manager
reqtype: Functional
version: 1

The Launch Manager shall notify the State Manger of a recovery action that results in a Run Target activation using the Control Interface.

Run target recovery action failure escalation
status: valid
security: NO
safety: ASIL_B
tags: lifecycle, launch_manager
reqtype: Functional
version: 1

The Launch Manager shall perform a transition to the Fallback Run Target if a Run Target recovery action fails.

Fallback run target recovery action failure escalation
status: invalid
security: NO
safety: ASIL_B
tags: not_planned, lifecycle, launch_manager
reqtype: Functional
version: 1

The Launch Manager shall stop servicing the Watchdog if the transition to the Fallback Run Target fails.

Component Recovery Actions#

Recovery Action - component failure reactivate the component
status: valid
security: NO
safety: ASIL_B
tags: lifecycle, launch_manager
reqtype: Functional
version: 1

The Launch Manager shall support reacting to a Component failure by reactivating the failed Component.

Recovery Action - component failure switch Run Target
status: valid
security: NO
safety: ASIL_B

The Launch Manager shall support reacting to a Component failure by switching to a configured Run Target.

Recovery Action - component failure stopping the component
status: invalid
security: NO
safety: ASIL_B
tags: unclear, lifecycle, launch_manager
reqtype: Functional
version: 1

The Launch Manager shall support reacting to a Component failure by stopping the failed Component.

Recovery Action - component failure replacing component
status: invalid
security: NO
safety: ASIL_B
tags: unclear, lifecycle, launch_manager
reqtype: Functional
version: 1

The Launch Manager shall support reacting to a Component failure by stopping the failed Component and then starting a configured Component instead.

Recovery Action - component failure switch to fallback run target
status: invalid
security: NO
safety: ASIL_B
tags: not_planned, lifecycle, launch_manager
reqtype: Functional
version: 1

The Launch Manager shall support reacting to a Component failure by switching to the Fallback Run Target.

Run Target Recovery Actions#

Recovery Action - run target failure switch Run Target
status: valid
security: NO
safety: ASIL_B
tags: lifecycle, launch_manager
reqtype: Functional
version: 1

The Launch Manager shall support reacting to a Run Target activation failure by switching to a configured Run Target.

Watchdog#

Launch manager external watchdog notification
status: valid
security: NO
safety: ASIL_B
tags: lifecycle, launch_manager
reqtype: Functional
version: 1

The Launch Manager shall trigger a notification to an external Watchdog for each successful self monitoring test execution.

Launch manager external watchdog notification - failed test
status: valid
security: NO
safety: ASIL_B
tags: lifecycle, launch_manager
reqtype: Functional
version: 1

The Launch Manager shall not trigger an external Watchdog notification if an internal health check failed.

Launch manager external monitoring configuration
status: valid
security: NO
safety: ASIL_B
tags: lifecycle, launch_manager
reqtype: Functional
version: 1

The Launch Manager shall support configuring the Interval of the internal health check executions.

Logging#

Logging slog2 and file support
status: valid
security: NO
safety: ASIL_B
tags: lifecycle, launch_manager
reqtype: Functional
version: 1

The Launch Manager shall support OS specific logging facilities to analyze the early boot sequence.

Logging state transitions
status: valid
security: NO
safety: ASIL_B
tags: lifecycle, launch_manager
reqtype: Functional
version: 1

The Launch Manager shall provide support for logging process launches, Processes exit/recovery, internal tasks, and interaction with external monitor.

Logging timestamp
status: valid
security: NO
safety: ASIL_B
tags: lifecycle, launch_manager
reqtype: Functional
version: 1

The Launch Manager logs shall contain timestamp information.

Logging DAG
status: valid
security: NO
safety: ASIL_B
tags: lifecycle, launch_manager
reqtype: Functional
version: 1

The Launch Manager shall provide the possibility to log the DAG in a human readable format, triggered via Control Interface.

Configuration dependency view
status: invalid
security: NO
safety: QM
tags: not_planned, lifecycle, launch_manager
reqtype: Functional
version: 1

The Launch Manager shall have the means to log the current dependencies in a format that can be visualized when requested.

Configuration file#

Configuration file support
status: invalid
security: NO
safety: ASIL_B
tags: not_planned, lifecycle, launch_manager
reqtype: Functional
version: 1

The launch manager shall provide modular configuration file support to configure process attributes.

Global process properties
status: valid
security: NO
safety: ASIL_B
tags: lifecycle, launch_manager
reqtype: Functional
version: 1

The Launch Manager shall be able to centrally define defaults for specific properties for the set of executables.

Lazy check of configured commands
status: valid
security: NO
safety: ASIL_B
tags: lifecycle, launch_manager
reqtype: Functional
version: 1

The Launch Manager shall check availability of executables in the filesystem only when the executable shall required to be executed.

Configuration Verification tool
status: invalid
security: NO
safety: QM
tags: unclear, lifecycle, launch_manager
reqtype: Functional
version: 1

The Launch Manager shall have a means to validate the configuration offline.