Requirements#
Orchestration Requirements
|
status: valid
security: YES
safety: ASIL_B
|
||||
Executor#
Task Management#
Async Cooperative Task Runtime
|
status: valid
security: NO
safety: QM
|
||||
The executor shall provide a cooperative task runtime for async programming based on the definition of Rust’s async model (see Asynchronous Programming in Rust <https://rust-lang.github.io/async-book>). |
|||||
Yielding Guidelines for Long Operations
|
status: valid
security: NO
safety: QM
|
||||
The executor shall provide guidelines for dividing long-running operations into smaller, cooperatively yielding segments. |
|||||
Dedicated Threads for Blocking Operations
|
status: valid
security: NO
safety: QM
|
||||
The system shall support execution of tasks containing blocking calls on dedicated OS threads isolated from cooperative scheduling. |
|||||
Special Tasks and Preemption#
Preemptive Scheduling for Safety Tasks
|
status: invalid
security: NO
safety: ASIL_B
|
||||
The Executor shall support preemptive scheduling of special safety-critical tasks, guaranteeing their execution. |
|||||
Separate Priority for Safety Tasks
|
status: invalid
security: NO
safety: ASIL_B
|
||||
Safety-critical tasks shall be prioritized separately from standard cooperative tasks. |
|||||
Thread Pool Configuration#
Fixed-Size Thread Pool
|
status: valid
security: NO
safety: QM
|
||||
Executor instances shall run tasks on a statically configured thread pool with a fixed thread count. |
|||||
Uniform OS Priority for Non-Safety Threads
|
status: valid
security: NO
safety: QM
|
||||
Threads within an Executor not involved in safety-critical tasks shall share identical OS-level priority. |
|||||
Configurable Thread Affinity
|
status: valid
security: NO
safety: QM
|
||||
Thread affinity to CPU cores shall be configurable per Executor instance. |
|||||
Isolated Thread Pools
|
status: valid
security: NO
safety: QM
|
||||
Executor instances shall isolate their thread pools from each other. |
|||||
Task Scheduling#
No Internal Priorities for Cooperative Tasks
|
status: valid
security: NO
safety: QM
|
||||
Cooperative tasks within an Executor shall execute without internal priority distinctions. |
|||||
FIFO or Fairness Scheduling
|
status: valid
security: NO
safety: QM
|
||||
The Executor shall support FIFO or fairness-based scheduling among cooperative tasks. |
|||||
Scale via Additional Executors
|
status: valid
security: NO
safety: QM
|
||||
Scaling of Executor resources shall be achieved through additional Executor instances rather than dynamic thread scaling. |
|||||
Orchestrator Requirements#
Program Definition#
Static Program Execution Graphs
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Orchestrator shall provide a runtime-static Program abstraction representing computation logic as execution graphs. |
|||||
Explicit Control Flows and Timing
|
status: valid
security: NO
safety: ASIL_B
|
||||
Programs shall explicitly define sequential, parallel, conditional execution flows, loops, and timing contracts. |
|||||
Event-Based Synchronization
|
status: valid
security: NO
safety: ASIL_B
|
||||
Programs shall support explicit event-based synchronization and trigger conditions. |
|||||
Fault-Handling and Monitors
|
status: valid
security: NO
safety: ASIL_B
|
||||
Programs shall contain integrated fault-handling logic and execution monitors to enforce timing constraints. |
|||||
API Design#
Code-First Integration API
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Orchestrator shall offer a code-first API to integrate directly with application logic without external DSL/IDL. |
|||||
Execution Model#
Single-Executor Deployment
|
status: valid
security: NO
safety: ASIL_B
|
||||
Each Program shall be deployed exclusively on a single Executor instance. |
|||||
Multi-Program Support per Executor
|
status: valid
security: NO
safety: ASIL_B
|
||||
Executors may host multiple Programs to support resource sharing. |
|||||
Event-Only Communication
|
status: valid
security: NO
safety: ASIL_B
|
||||
Programs shall communicate exclusively through explicitly defined events. |
|||||
Special Safety Task Integration#
Safety Tasks in Programs
|
status: invalid
security: NO
safety: ASIL_B
|
||||
Critical timing or safety paths within Programs shall be executed via preemptive special tasks provided by the Executor. |
|||||
Observability Requirements#
Trace Correlation Points
|
status: valid
security: NO
safety: QM
|
||||
The Executor and Orchestrator shall expose structured tracing points correlating user-space task scheduling with OS-level scheduling. |
|||||
Task Lifecycle and Queue Metrics
|
status: valid
security: NO
safety: QM
|
||||
Observability shall capture task lifecycle events, Executor queue metrics, and mapping of user-space tasks to OS threads. |
|||||
Program Flow and Timing Visibility
|
status: valid
security: NO
safety: QM
|
||||
Observability shall provide visibility into Program execution flow, event synchronization points, and timing violations. |
|||||
Integration with Tracing Frameworks
|
status: valid
security: NO
safety: QM
|
||||
Tracing points shall integrate seamlessly with established tracing frameworks like Perfetto and LTTng. |
|||||
External Supervision Requirements#
Health Indicators Export
|
status: valid
security: NO
safety: QM
|
||||
Executor and Orchestrator frameworks shall expose health indicators for integration with external supervisory systems. |
|||||
Internal Task Health Verification
|
status: valid
security: NO
safety: QM
|
||||
Frameworks shall internally verify task-level health status based on timing constraints and fault-handling execution. |
|||||
General Constraints#
Determinism and Scalability
|
status: valid
security: NO
safety: QM
|
||||
The Executor and Orchestrator shall maintain determinism and scalability suitable for mixed-criticality environments. |
|||||
Explicit Preemption Activation
|
status: invalid
security: NO
safety: ASIL_B
|
||||
Preemptive scheduling shall only be activated explicitly for tasks with safety or critical timing constraints. |
|||||
Exclusive Use of IPC Feature for Inter Process Synchronization
|
status: invalid
security: YES
safety: ASIL_B
|
||||
The system shall use the approved IPC feature exclusively for all inter-process synchronization. |
|||||