KVS FMEA (Failure Modes and Effects Analysis)

KVS FMEA		status: valid security: NO safety: ASIL_B
tags: Persistency KVS version: 1 realizes: wp__sw_component_fmea
doc__kvs_fmea		Generic Document

Failure modes at the component interfaces are analysed in Persistency FMEA (doc__persistency_fmea). This FMEA applies the fault models of gd_guidl__fault_models to the mechanisms specified in KVS Requirements (doc__kvs_requirements). The scope is defined in Persistency Safety Plan (doc__persistency_safety_plan) (tailoring).

Failure Mode List

Table 27 Fault Models for the component mechanisms

ID	Failure Mode	Applicability	Rationale
MF_01_01	message is not received (is a subset/more precise description of MF_01_05)	no	See Message is not received (feat_saf_fmea__persistency__msg_not_received).
MF_01_02	message received too late (only relevant if delay is a realistic fault)	no	See Message received too late (feat_saf_fmea__persistency__late_message).
MF_01_03	message received too early (usually not a problem)	no	Synchronous calls; an early response is not possible.
MF_01_04	message not received correctly by all recipients (different messages or messages partly lost). Only relevant if the same message goes to multiple recipients.	no	Every message has exactly one recipient.
MF_01_05	message is corrupted	yes	Flush is interrupted (comp_saf_fmea__kvs__flush_interrupted), Corrupted storage at open, ... (comp_saf_fmea__kvs__corrupt_on_open), Default value file is corru... (comp_saf_fmea__kvs__default_corrupt)
MF_01_06	message is not sent	yes	Flush does not write change... (comp_saf_fmea__kvs__flush_skipped)
MF_01_07	message is unintended sent	no	Storage is only written by flush, snapshots only changed on explicit call (Explicit Flush (comp_req__kvs__explicit_flush), Explicit Snapshot Operations (comp_req__kvs__explicit_snapshot_operations)). Implementation: flush rotates the snapshots.
CO_01_01	minimum constraint boundary is violated	yes	Constraint boundary is viol... (comp_saf_fmea__kvs__constraint_exceeded)
CO_01_02	maximum constraint boundary is violated	yes	Constraint boundary is viol... (comp_saf_fmea__kvs__constraint_exceeded), Wrong constraint configurat... (comp_saf_fmea__kvs__constraint_cfg_wrong)
EX_01_01	Process calculates wrong result(s) (is a subset/more precise description of MF_01_05 or MF_01_04). This failure mode is related to the analysis if e.g. internal safety mechanisms are required (level 2 function, plausibility check of the output, …) because of the size / complexity of the feature.	yes	Empty storage is used inste... (comp_saf_fmea__kvs__empty_storage_used), Data migration produces wro... (comp_saf_fmea__kvs__migration_wrong), Kvs tool generates wrong st... (comp_saf_fmea__kvs__tool_wrong_output)
EX_01_02	processing too slow (only relevant if timing is considered)	no	See Message received too late (feat_saf_fmea__persistency__late_message).
EX_01_03	processing too fast (only relevant if timing is considered)	no	No minimum processing time required.
EX_01_04	loss of execution	yes	Changes are lost by loss of... (comp_saf_fmea__kvs__unflushed_lost)
EX_01_05	processing changes to arbitrary process	no	Runs in the calling thread; control flow corruption: platform DFA.
EX_01_06	processing is not complete (infinite loop)	no	All loops iterate over finite data.

FMEA

Flush is interrupted		status: valid
failure_effect: Data and hash file are written incompletely. failure_root_cause: Reset or power loss during the flush, write error of the storage medium. fault_id: MF_01_05 safety_relevant: yes sufficient: yes version: 1 mitigated_by: comp_req__kvs__atomic_store, comp_req__kvs__corruption_detect_open, comp_req__kvs__pers_data_csum, comp_req__kvs__recovery_snapshot_restore, comp_req__kvs__reset_resistant_write violates: comp_arc_sta__persistency_kvs__sv
The previous state is kept until the flush is complete; an incomplete flush is detected at the next open. Implementation: the previous state is only kept by the snapshot rotation, so with a maximum snapshot count of 0 Reset Resistant Write (comp_req__kvs__reset_resistant_write) is not met.
comp_saf_fmea__kvs__flush_interrupted		Component FMEA (Failure Mode and Effects Analysis)

Corrupted storage at open, reload or snapshot restore		status: valid
failure_effect: Corrupted or inconsistent data is loaded into the in-memory cache. failure_root_cause: Interrupted flush, fault of the storage medium, data or hash file missing or modified by another software element. fault_id: MF_01_05 safety_relevant: yes sufficient: yes version: 1 mitigated_by: comp_req__kvs__corruption_detect_open, comp_req__kvs__key_uniqueness, comp_req__kvs__open_need_kvs_behavior, comp_req__kvs__permission_err_hndl, comp_req__kvs__pers_data_csum_vrfy violates: comp_arc_sta__persistency_kvs__sv
Applies to every load: open, Discard Pending Changes (comp_req__kvs__discard_pending_changes_api) and snapshot restore. Implementation (Rust): a missing hash file is reported as FileNotFound, so with Optional the instance is opened with empty storage although the data file exists.
comp_saf_fmea__kvs__corrupt_on_open		Component FMEA (Failure Mode and Effects Analysis)

Empty storage is used instead of persisted data		status: valid
failure_effect: The application reads default values instead of the persisted values without an error being reported. failure_root_cause: Open with ``Ignore``, or with ``Optional`` while no storage file exists (e.g. wrong storage path). fault_id: EX_01_01 safety_relevant: yes sufficient: yes version: 1 mitigated_by: aou_req__persistency__start_without_data, comp_req__kvs__default_value_is_default_api, comp_req__kvs__key_exists_api, comp_req__kvs__open_need_kvs_behavior violates: comp_arc_sta__persistency_kvs__sv
The application selects the open behavior and can detect values which are not persisted.
comp_saf_fmea__kvs__empty_storage_used		Component FMEA (Failure Mode and Effects Analysis)

Default value file is corrupted or modified		status: valid
failure_effect: Wrong default values are provided to the application. failure_root_cause: Fault of the storage medium, modification of the default value file after deployment. fault_id: MF_01_05 safety_relevant: yes sufficient: yes version: 1 mitigated_by: comp_req__kvs__default_storage_permissions, comp_req__kvs__default_val_chksum, comp_req__kvs__default_value_cfg_tool violates: comp_arc_sta__persistency_kvs__sv
Implementation: the kvs tool does not set the file permissions.
comp_saf_fmea__kvs__default_corrupt		Component FMEA (Failure Mode and Effects Analysis)

Flush does not write changed data		status: valid
failure_effect: Flush returns without error, but the changes are lost at the next reset. failure_root_cause: The change detection of :need:`comp_req__kvs__write_amplification` misses a change. fault_id: MF_01_06 safety_relevant: yes sufficient: no version: 1 mitigated_by: comp_req__kvs__explicit_flush, comp_req__kvs__write_amplification violates: comp_arc_sta__persistency_kvs__sv
A missed change is not detected by the checksum, which covers the written data only. Not sufficient: it is not specified that every modifying operation marks the data as changed. Implementation: no change detection, flush always writes.
comp_saf_fmea__kvs__flush_skipped		Component FMEA (Failure Mode and Effects Analysis)

Constraint boundary is violated		status: valid
failure_effect: A key, the snapshots or the persisted data exceed the configured limits, or an invalid snapshot slot is used. failure_root_cause: The application passes an invalid key or snapshot slot index, or stores more data than configured. fault_id: CO_01_02 safety_relevant: yes sufficient: no version: 1 mitigated_by: comp_req__kvs__constraints, comp_req__kvs__key_length, comp_req__kvs__key_naming, comp_req__kvs__no_dynamic_memory, comp_req__kvs__snapshot_max_num_cfg, comp_req__kvs__snapshot_remove_api, comp_req__kvs__snapshot_restore_api, comp_req__kvs__snapshot_slot_index_vali violates: comp_arc_sta__persistency_kvs__sv
Not sufficient: Snapshot Slot Index Validation (comp_req__kvs__snapshot_slot_index_vali) checks the fixed range of Snapshot Slot Indexing (comp_req__kvs__snapshot_id_api), not the configured maximum of Maximum Number of Snapshots (comp_req__kvs__snapshot_max_num_cfg). A snapshot above the configured maximum exceeds the configured storage. Implementation: Rust does not validate keys; the snapshot create, remove and slot query API is missing.
comp_saf_fmea__kvs__constraint_exceeded		Component FMEA (Failure Mode and Effects Analysis)

Wrong constraint configuration file		status: valid
failure_effect: The instance operates with wrong limits, e.g. snapshots disabled or limits above the dimensioned memory. failure_root_cause: Corrupted, modified or wrong configuration file. fault_id: CO_01_02 safety_relevant: yes sufficient: no version: 1 mitigated_by: comp_req__kvs__constraints, comp_req__kvs__constraints_priority violates: comp_arc_sta__persistency_kvs__sv
The file overrides the compile-time values (Constraint Configuration pr... (comp_req__kvs__constraints_priority)). Not sufficient: no integrity or plausibility check of the file is specified.
comp_saf_fmea__kvs__constraint_cfg_wrong		Component FMEA (Failure Mode and Effects Analysis)

Data migration produces wrong data		status: valid
failure_effect: Migrated values differ from the original values and are persisted at the next flush. failure_root_cause: Systematic fault in the migration, unsupported schema version. fault_id: EX_01_01 safety_relevant: yes sufficient: no version: 1 mitigated_by: comp_req__kvs__pers_data_migration, comp_req__kvs__pers_data_schema, comp_req__kvs__pers_data_version violates: comp_arc_sta__persistency_kvs__sv
The checksum does not cover the correctness of the migration. Not sufficient: it is not specified that an unsupported schema version is reported and that the original data is kept until the migrated data is flushed. Implementation: schema version and migration are missing.
comp_saf_fmea__kvs__migration_wrong		Component FMEA (Failure Mode and Effects Analysis)

Changes are lost by loss of execution		status: valid
failure_effect: Changes which are not flushed are lost; after restart the last flushed state is provided. failure_root_cause: Termination of the calling process or reset before the flush. fault_id: EX_01_04 safety_relevant: yes sufficient: yes version: 1 mitigated_by: aou_req__kvs__filesystem, aou_req__persistency__flush, comp_req__kvs__cached_access, comp_req__kvs__explicit_flush violates: comp_arc_sta__persistency_kvs__sv
Interrupted flush: Flush is interrupted (comp_saf_fmea__kvs__flush_interrupted).
comp_saf_fmea__kvs__unflushed_lost		Component FMEA (Failure Mode and Effects Analysis)

Kvs tool generates wrong storage or default value files		status: valid
failure_effect: Wrong default or persisted values are provided without an error being reported. failure_root_cause: Systematic fault of the kvs tool. fault_id: EX_01_01 safety_relevant: yes sufficient: no version: 1 mitigated_by: comp_req__kvs__default_val_chksum, comp_req__kvs__default_value_cfg_tool, comp_req__kvs__pers_data_csum, comp_req__kvs__storage_tool violates: comp_arc_sta__persistency_kvs__sv
The tool computes the checksum over its own output, so wrong content is not detected at loading. Not sufficient: neither a tool qualification nor a verification of the generated files is specified.
comp_saf_fmea__kvs__tool_wrong_output		Component FMEA (Failure Mode and Effects Analysis)