Persistency Failure Modes and Effects Analysis

Persistency FMEA		status: valid security: NO safety: ASIL_B
tags: persistency version: 1 realizes: wp__feature_fmea
doc__persistency_fmea		Generic Document

The FMEA applies the fault models of gd_guidl__fault_models to the dynamic views of Persistency KVS Feature Arc... (doc__persistency_kvs_architecture).

Failure Mode List

Table 18 Fault Models for sequence diagrams

ID	Failure Mode	Applicability	Rationale
MF_01_01	message is not received (is a subset/more precise description of MF_01_05)	yes	Message is not received (feat_saf_fmea__persistency__msg_not_received)
MF_01_02	message received too late (only relevant if delay is a realistic fault)	yes	Message received too late (feat_saf_fmea__persistency__late_message)
MF_01_03	message received too early (usually not a problem)	no	Synchronous calls with response; an early response is not possible.
MF_01_04	message not received correctly by all recipients (different messages or messages partly lost). Only relevant if the same message goes to multiple recipients.	no	Every message has exactly one recipient.
MF_01_05	message is corrupted	yes	Message is corrupted betwee... (feat_saf_fmea__persistency__corrupted_message), Persisted data is corrupted... (feat_saf_fmea__persistency__corrupt_load), Persisted data is corrupted... (feat_saf_fmea__persistency__corrupt_store)
MF_01_06	message is not sent	yes	Message is not sent (feat_saf_fmea__persistency__not_sent)
MF_01_07	message is unintended sent	no	Messages to json and filesystem are only sent on a user request; data is only written on explicit flush.
CO_01_01	minimum constraint boundary is violated	no	No minimum constraints are defined (snapshot max count 0 is valid and disables snapshots).
CO_01_02	maximum constraint boundary is violated	yes	Maximum constraint boundary... (feat_saf_fmea__persistency__constraint_max)
EX_01_01	Process calculates wrong result(s) (is a subset/more precise description of MF_01_05 or MF_01_04). This failure mode is related to the analysis if e.g. internal safety mechanisms are required (level 2 function, plausibility check of the output, …) because of the size / complexity of the feature.	no	No calculations on values, only storing and (de)serialization. Systematic faults are addressed by ASIL B development and verification; corruption is covered by MF_01_05.
EX_01_02	processing too slow (only relevant if timing is considered)	yes	Covered by Message received too late (feat_saf_fmea__persistency__late_message).
EX_01_03	processing too fast (only relevant if timing is considered)	no	No minimum processing time required; no hazardous effect.
EX_01_04	loss of execution	yes	Loss of execution (feat_saf_fmea__persistency__err_handl)
EX_01_05	processing changes to arbitrary process	no	The kvs runs in the calling thread. Control flow changes by HW faults or memory corruption are covered by the platform DFA and the environment assumptions.
EX_01_06	processing is not complete (infinite loop)	no	All loops iterate over finite data (keys, file content, snapshots); parsing ends with the input.

FMEA

Message is not received		status: valid
failure_effect: Request or response is not received, the operation is not performed or its result is not available. failure_root_cause: The call does not return, e.g. due to a blocked execution context or a file system access that does not complete. fault_id: MF_01_01 safety_relevant: yes sufficient: yes version: 2 mitigated_by: aou_req__persistency__error_handling violates: feat_arc_dyn__persistency__check_key_default, feat_arc_dyn__persistency__delete_key, feat_arc_dyn__persistency__flush, feat_arc_dyn__persistency__read_from_storage, feat_arc_dyn__persistency__read_key, feat_arc_dyn__persistency__snapshot_restore, feat_arc_dyn__persistency__write_key
Applies to all messages between user and kvs and to the responses of json and filesystem. The effect is an unavailability of the persistency (call does not return), which the application detects and handles (Persistency Error handling (aou_req__persistency__error_handling)). No wrong data is used.
feat_saf_fmea__persistency__msg_not_received		Feature FMEA (Failure Mode and Effects Analysis)

Message received too late		status: valid
failure_effect: The response is received too late. failure_root_cause: Long file system access times or delayed scheduling of the calling execution context. fault_id: MF_01_02 safety_relevant: yes sufficient: yes version: 2 mitigated_by: aou_req__persistency__error_handling violates: feat_arc_dyn__persistency__check_key_default, feat_arc_dyn__persistency__delete_key, feat_arc_dyn__persistency__flush, feat_arc_dyn__persistency__read_from_storage, feat_arc_dyn__persistency__read_key, feat_arc_dyn__persistency__snapshot_restore, feat_arc_dyn__persistency__write_key
Relevant for operations accessing the file system (load, flush, snapshot restore). Same effect as MF_01_01, handled by Persistency Error handling (aou_req__persistency__error_handling). feat_req__persistency__async_api avoids blocking for time consuming operations.
feat_saf_fmea__persistency__late_message		Feature FMEA (Failure Mode and Effects Analysis)

Message is corrupted between user and kvs		status: valid
failure_effect: A key or value passed between user and kvs is corrupted. failure_root_cause: Random hardware fault or memory corruption by another software element of the same process. fault_id: MF_01_05 safety_relevant: yes sufficient: yes version: 2 mitigated_by: aou_req__persistency__error_handling violates: feat_arc_dyn__persistency__check_key_default, feat_arc_dyn__persistency__delete_key, feat_arc_dyn__persistency__read_key, feat_arc_dyn__persistency__write_key
The messages are function calls within the same process. Corruption is only possible by random HW faults (environment assumptions) or memory corruption by other software elements (Persistency DFA (doc__persistency_dfa)). Reported errors are handled by Persistency Error handling (aou_req__persistency__error_handling).
feat_saf_fmea__persistency__corrupted_message		Feature FMEA (Failure Mode and Effects Analysis)

Persisted data is corrupted when loading		status: valid
failure_effect: Corrupted data or hash file content is read from the file system. failure_root_cause: Fault of the storage medium, interrupted write operation or modification of the files by another software element. fault_id: MF_01_05 safety_relevant: yes sufficient: yes version: 2 mitigated_by: aou_req__persistency__error_handling, aou_req__persistency__start_without_data, feat_req__persistency__integrity_check, feat_req__persistency__snapshot_restore violates: feat_arc_dyn__persistency__read_from_storage, feat_arc_dyn__persistency__snapshot_restore
The kvs checks the hash before parsing (feat_req__persistency__integrity_check) and reports Validation-Failed-Error; invalid JSON is reported as JSON-Parser-Error. Corrupted data is never provided. The application handles the error (Persistency Error handling (aou_req__persistency__error_handling)), e.g. by restoring a snapshot (feat_req__persistency__snapshot_restore). If no persisted data is available, the kvs provides only default values; the application configures whether this is accepted (Start without Persisted Data (aou_req__persistency__start_without_data)).
feat_saf_fmea__persistency__corrupt_load		Feature FMEA (Failure Mode and Effects Analysis)

Persisted data is corrupted when storing		status: valid
failure_effect: Data or hash file is written corrupted or incomplete (e.g. interrupted write). failure_root_cause: Reset or power loss during the write operation, or fault of the storage medium. fault_id: MF_01_05 safety_relevant: yes sufficient: yes version: 2 mitigated_by: aou_req__persistency__error_handling, aou_req__persistency__flush, feat_req__persistency__integrity_check, feat_req__persistency__recovery_from_reset, feat_req__persistency__reset_resistant violates: feat_arc_dyn__persistency__flush
Write operations are reset resistant (feat_req__persistency__reset_resistant, feat_req__persistency__recovery_from_reset). An inconsistent data/hash pair is detected at the next load (Persisted data is corrupted... (feat_saf_fmea__persistency__corrupt_load)). Write errors are reported as Physical-Storage-Failure. The application considers changes as persisted only after a flush without error (Flush of Safety Relevant Ch... (aou_req__persistency__flush)).
feat_saf_fmea__persistency__corrupt_store		Feature FMEA (Failure Mode and Effects Analysis)

Message is not sent		status: valid
failure_effect: A response or write request is not sent. failure_root_cause: Systematic fault in the kvs or in the used baselibs interfaces, or failed file system operation. fault_id: MF_01_06 safety_relevant: yes sufficient: yes version: 2 mitigated_by: aou_req__persistency__error_handling violates: feat_arc_dyn__persistency__check_key_default, feat_arc_dyn__persistency__delete_key, feat_arc_dyn__persistency__flush, feat_arc_dyn__persistency__read_from_storage, feat_arc_dyn__persistency__read_key, feat_arc_dyn__persistency__snapshot_restore, feat_arc_dyn__persistency__write_key
Same effect as Message is not received (feat_saf_fmea__persistency__msg_not_received). A missing write in the flush view is reported as Physical-Storage-Failure.
feat_saf_fmea__persistency__not_sent		Feature FMEA (Failure Mode and Effects Analysis)

Maximum constraint boundary is violated		status: valid
failure_effect: A key, value or the persisted data exceeds the configured maximum. failure_root_cause: The application stores keys, values or data exceeding the configured limits. fault_id: CO_01_02 safety_relevant: yes sufficient: yes version: 2 mitigated_by: aou_req__persistency__error_handling, feat_req__persistency__cfg violates: feat_arc_dyn__persistency__flush, feat_arc_dyn__persistency__read_from_storage, feat_arc_dyn__persistency__write_key
Limits are configured according to feat_req__persistency__cfg. Exceeding the storage results in Physical-Storage-Failure; persisted data and snapshots remain unchanged. Note: Key Length (comp_req__kvs__key_length) is not yet enforced by the implementation (component level).
feat_saf_fmea__persistency__constraint_max		Feature FMEA (Failure Mode and Effects Analysis)

Loss of execution		status: valid
failure_effect: The persistency is not available. failure_root_cause: Termination of the calling thread or process. fault_id: EX_01_04 safety_relevant: yes sufficient: yes version: 2 mitigated_by: aou_req__persistency__error_handling violates: feat_arc_dyn__persistency__check_key_default, feat_arc_dyn__persistency__delete_key, feat_arc_dyn__persistency__flush, feat_arc_dyn__persistency__read_from_storage, feat_arc_dyn__persistency__read_key, feat_arc_dyn__persistency__snapshot_restore, feat_arc_dyn__persistency__write_key
The kvs runs in the calling context, so a loss of execution stops the application itself. An interrupted flush is covered by Persisted data is corrupted... (feat_saf_fmea__persistency__corrupt_store). Handled by Persistency Error handling (aou_req__persistency__error_handling).
feat_saf_fmea__persistency__err_handl		Feature FMEA (Failure Mode and Effects Analysis)