Requirements#
HealthMonitor Requirements
|
status: draft
security: NO
safety: ASIL_B
|
||||
Safety Concept Summary#
The Health Monitor is an in-process library that supervises the application it is linked into. It detects deviations from the configured temporal and logical behavior and reacts by withholding the alive notification towards the Launch Manager.
Safe state: the absence of alive notifications. The Launch Manager detects the missing notification via its alive supervision and executes the configured Recovery Action.
Fail-silent principle: any failure, whether detected in the application or internal to the Health Monitor (crash, hang, panic, starvation), ends in the same safe state. A fault can therefore never make the Health Monitor report “alive” for a failed application.
Detection channel: the Launch Manager alive supervision is the independent channel that covers failures of the Health Monitor itself.
General#
Configuration validation
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Health Monitor shall reject a configuration and not create a monitoring instance if any of the following holds:
Note Monitor specific configuration checks are specified in the section of the respective monitor and in Time range validation (comp_req__health_monitor__cfg_time_range). |
|||||
Time range validation
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Health Monitor shall not accept a time range whose minimum is greater than its maximum. |
|||||
Time granularity
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Health Monitor shall handle time ranges and cycle durations with a granularity of one millisecond. |
|||||
Unique identification
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Health Monitor shall identify each configured element by an identifier that is unique within its scope:
|
|||||
Complete monitor activation
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Health Monitor shall refuse to start supervision unless every configured monitor has been acquired by the application. Note Prevents a monitor that is configured but never fed from silently staying unsupervised. |
|||||
Exclusive monitor ownership
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Health Monitor shall hand out each monitor and each deadline at most once, and shall return an error on any further acquisition attempt. |
|||||
Cyclic evaluation
|
status: valid
security: NO
safety: ASIL_B
|
||||
Once started, the Health Monitor shall evaluate all monitors with the configured internal evaluation cycle, independently of the application threads that report to them. |
|||||
Monotonic time base
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Health Monitor shall base all time supervision on a monotonic clock that is not affected by wall-clock adjustments. |
|||||
Heartbeat (Checkpoint) Supervision#
Heartbeat configuration validation
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Health Monitor shall reject a heartbeat monitor configuration if the internal evaluation cycle is greater than or equal to twice the minimum of the heartbeat time range. Note Ensures that a correctly behaving application never reports more than one heartbeat within one internal evaluation cycle. See Multiple heartbeats (comp_req__health_monitor__hb_multiple). |
|||||
Heartbeat too late
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Health Monitor shall detect a heartbeat failure if no heartbeat is reported before the maximum of the configured heartbeat time range has elapsed. |
|||||
Heartbeat too early
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Health Monitor shall detect a heartbeat failure if a heartbeat is reported before the minimum of the configured heartbeat time range has elapsed. |
|||||
Multiple heartbeats
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Health Monitor shall detect a heartbeat failure if more than one heartbeat is reported within one internal evaluation cycle. Note Only the latest heartbeat of an evaluation cycle is kept, so additional heartbeats cannot be checked against the time range individually. Without this check, a later heartbeat could mask an earlier one that was reported too early. |
|||||
Deadline Supervision#
Deadline configuration validation
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Health Monitor shall reject a deadline monitor configuration that contains no deadline. |
|||||
Deadline missed
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Health Monitor shall detect a deadline failure if a started deadline is not stopped before the configured maximum time has elapsed, including the case where it is never stopped. |
|||||
Deadline too early
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Health Monitor shall detect a deadline failure if a started deadline is stopped before the configured minimum time has elapsed. |
|||||
Failed deadline reuse
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Health Monitor shall return an error to the caller when a deadline that has already failed is started again. |
|||||
Logical Supervision#
Logic configuration validation
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Health Monitor shall reject a logic monitor configuration if any of the following holds:
|
|||||
Initial logical state
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Health Monitor shall put every logic monitor into its configured initial state when the monitor is created. |
|||||
Invalid transition
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Health Monitor shall detect a logical failure if a reported transition is not among the configured allowed transitions from the current state, and shall return an error to the caller. |
|||||
Unknown state
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Health Monitor shall detect a logical failure if a transition to a state that is not configured is reported, and shall return an error to the caller. |
|||||
Error Reaction#
Alive notification
|
status: valid
security: NO
safety: ASIL_B
|
||||
While no failure has been detected, the Health Monitor shall send an alive notification to the Launch Manager once per configured supervisor notification cycle. |
|||||
Withhold alive on failure
|
status: valid
security: NO
safety: ASIL_B
|
||||
On detection of any supervision failure, the Health Monitor shall stop sending alive notifications to the Launch Manager. |
|||||
Failure latching
|
status: valid
security: NO
safety: ASIL_B
|
||||
Once a supervision failure has been detected, the Health Monitor shall not resume alive notifications for the lifetime of the monitoring instance. |
|||||
Fail-silent on internal error
|
status: valid
security: NO
safety: ASIL_B
|
||||
On any internal error, the Health Monitor shall stop sending alive notifications to the Launch Manager. Note Internal errors include an inconsistent monitor state, a time calculation overflow, and abnormal termination of the evaluation thread. |
|||||
Detection latency
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Health Monitor shall detect a supervision failure no later than one internal evaluation cycle after the failure condition has occurred. Note Together with the Launch Manager alive supervision timeout, this bounds the fault reaction time. See Fault tolerant time budget (aou_req__health_monitor__ftti_budget). |
|||||
Failure logging
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Health Monitor shall log each detected supervision failure with the monitor tag and the failure type. |
|||||
Robustness and Freedom from Interference#
Static memory after start
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Health Monitor shall not allocate dynamic memory after supervision has been started. |
|||||
Bounded, non-blocking reporting
|
status: valid
security: NO
safety: ASIL_B
|
||||
The reporting operations of the Health Monitor (heartbeat, deadline start and stop, state transition) shall have a bounded execution time, and shall not block the calling thread. |
|||||
Concurrent reporting
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Health Monitor shall keep the monitor state consistent when reporting and cyclic evaluation run concurrently on different threads. |
|||||
Memory corruption detection
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Health Monitor shall place its monitoring data between inaccessible memory pages, so that a write that runs across the boundaries of that data is detected. Note Measure for HM_FMEA_003. It detects bulk memory corruption only. Targeted corruption of the monitoring data is covered by Host application integrity (aou_req__health_monitor__host_integrity). Note Further measure like Arm Memory Tagging Extension will be investigated in the future. |
|||||
Placeholder#
Dummy Component
|
status: valid
security: YES
safety: ASIL_B
|
||||
|
|||||