Skip to content

Commit 3de5f58

Browse files
PandaeDoPandaeDo
committed
update safety analysis templates
1 parent 55cfdcc commit 3de5f58

5 files changed

Lines changed: 793 additions & 0 deletions

File tree

‎process/folder_templates/features/feature_name/safety_analysis/dfa.rst‎

Lines changed: 213 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,9 +34,222 @@ DFA (Dependent Failure Analysis)
3434
- Adjust ``status`` to be ``valid``
3535
- Adjust ``safety`` and ``tags`` according to your needs
3636

37+
The DFA for the feature [Your Feature Name] is performed. To show evidence that all failure initiators are considered, the applicability has to be filled out in the
38+
following tables. For all applicable failure initiators, the DFA has to be performed.
39+
3740
Dependent Failure Initiators
3841
----------------------------
3942

43+
2.1 Shared resources
44+
45+
.. note:: Shared libraries is only than applicable as a shared resource if the feature and the related safety mechanisms are using this specific library. If the library is not used by the feature or the related safety mechanisms, it is not a shared resource.
46+
47+
48+
.. list-table:: DFA shared resources (used for Platform DFA)
49+
:header-rows: 1
50+
:widths: 10,20,10,20
51+
52+
* - ID
53+
- Violation cause shared resources
54+
- Applicability
55+
- Rationale
56+
* - SR_01_01
57+
- Reused software modules
58+
- <yes | no>
59+
- <Rationale if not applicable, otherwise link to filled out DFA>
60+
* - SR_01_02
61+
- Libraries
62+
- <yes | no>
63+
- <Rationale if not applicable, otherwise link to filled out DFA>
64+
* - SR_01_04
65+
- Basic software
66+
- <yes | no>
67+
- <Rationale if not applicable, otherwise link to filled out DFA>
68+
* - SR_01_05
69+
- Operating system including scheduler
70+
- <yes | no>
71+
- <Rationale if not applicable, otherwise link to filled out DFA>
72+
* - SR_01_06
73+
- Any service stack, e.g. communication stack
74+
- <yes | no>
75+
- <Rationale if not applicable, otherwise link to filled out DFA>
76+
* - SR_01_07
77+
- Configuration data
78+
- <yes | no>
79+
- <Rationale if not applicable, otherwise link to filled out DFA>
80+
* - SR_01_09
81+
- Execution time
82+
- <yes | no>
83+
- <Rationale if not applicable, otherwise link to filled out DFA>
84+
* - SR_01_10
85+
- Allocated memory
86+
- <yes | no>
87+
- <Rationale if not applicable, otherwise link to filled out DFA>
88+
89+
90+
| 2.2 Communication between the two elements:
91+
| Receiving function is affected by information that is false, lost, sent multiple times, or in the wrong order etc. from the sender.
92+
93+
.. list-table:: DFA communication between elements
94+
:header-rows: 1
95+
:widths: 10,20,10,20
96+
97+
* - ID
98+
- Violation cause communication between elements
99+
- Applicability
100+
- Rationale
101+
* - CO_01_01
102+
- Information passed via argument through a function call, or via writing/reading a variable being global to the two software functions (data flow)
103+
- <yes | no>
104+
- <Rationale if not applicable, otherwise link to filled out DFA>
105+
* - CO_01_02
106+
- Data or message corruption / repetition / loss / delay / masquerading or incorrect addressing of information
107+
- <yes | no>
108+
- <Rationale if not applicable, otherwise link to filled out DFA>
109+
* - CO_01_03
110+
- Insertion / sequence of information
111+
- <yes | no>
112+
- <Rationale if not applicable, otherwise link to filled out DFA>
113+
* - CO_01_04
114+
- Corruption of information, inconsistent data
115+
- <yes | no>
116+
- <Rationale if not applicable, otherwise link to filled out DFA>
117+
* - CO_01_05
118+
- Asymmetric information sent from a sender to multiple receivers, so that not all defined receivers have the same information
119+
- <yes | no>
120+
- <Rationale if not applicable, otherwise link to filled out DFA>
121+
* - CO_01_06
122+
- Information from a sender received by only a subset of the receivers
123+
- <yes | no>
124+
- <Rationale if not applicable, otherwise link to filled out DFA>
125+
* - CO_01_07
126+
- Blocking access to a communication channel
127+
- <yes | no>
128+
- <Rationale if not applicable, otherwise link to filled out DFA>
129+
130+
| 2.3 Shared information inputs
131+
| Same information input used by multiple functions.
132+
133+
.. list-table:: DFA shared information inputs
134+
:header-rows: 1
135+
:widths: 10,20,10,20
136+
137+
* - ID
138+
- Violation cause shared information inputs
139+
- Applicability
140+
- Rationale
141+
* - SI_01_02
142+
- Configuration data
143+
- <yes | no>
144+
- <Rationale if not applicable, otherwise link to filled out DFA>
145+
* - SI_01_03
146+
- Constants, or variables, being global to the two software functions
147+
- <yes | no>
148+
- <Rationale if not applicable, otherwise link to filled out DFA>
149+
* - SI_01_04
150+
- Basic software passes data (read from hardware register and converted into logical information) to two applications software functions
151+
- <yes | no>
152+
- <Rationale if not applicable, otherwise link to filled out DFA>
153+
* - SI_01_05
154+
- Data / function parameter arguments / messages delivered by software function to more than one other function
155+
- <yes | no>
156+
- <Rationale if not applicable, otherwise link to filled out DFA>
157+
158+
| 2.4 Unintended impact
159+
| Unintended impacts to function due to various failures.
160+
161+
.. list-table:: DFA unintended impact
162+
:header-rows: 1
163+
:widths: 10,20,10,20
164+
165+
* - ID
166+
- Violation cause unintended impact
167+
- Applicability
168+
- Rationale
169+
* - UI_01_01
170+
- Memory miss-allocation and leaks
171+
- <yes | no>
172+
- <Rationale if not applicable, otherwise link to filled out DFA>
173+
* - UI_01_02
174+
- Read/Write access to memory allocated to another software element
175+
- <yes | no>
176+
- <Rationale if not applicable, otherwise link to filled out DFA>
177+
* - UI_01_03
178+
- Stack/Buffer under-/overflow
179+
- <yes | no>
180+
- <Rationale if not applicable, otherwise link to filled out DFA>
181+
* - UI_01_04
182+
- Deadlocks
183+
- <yes | no>
184+
- <Rationale if not applicable, otherwise link to filled out DFA>
185+
* - UI_01_05
186+
- Livelocks
187+
- <yes | no>
188+
- <Rationale if not applicable, otherwise link to filled out DFA>
189+
* - UI_01_06
190+
- Blocking of execution
191+
- <yes | no>
192+
- <Rationale if not applicable, otherwise link to filled out DFA>
193+
* - UI_01_07
194+
- Incorrect allocation of execution time
195+
- <yes | no>
196+
- <Rationale if not applicable, otherwise link to filled out DFA>
197+
* - UI_01_08
198+
- Incorrect execution flow
199+
- <yes | no>
200+
- <Rationale if not applicable, otherwise link to filled out DFA>
201+
* - UI_01_09
202+
- Incorrect synchronization between software elements
203+
- <yes | no>
204+
- <Rationale if not applicable, otherwise link to filled out DFA>
205+
* - UI_01_10
206+
- CPU time depletion
207+
- <yes | no>
208+
- <Rationale if not applicable, otherwise link to filled out DFA>
209+
* - UI_01_11
210+
- Memory depletion
211+
- <yes | no>
212+
- <Rationale if not applicable, otherwise link to filled out DFA>
213+
* - UI_01_12
214+
- Other HW unavailability
215+
- <yes | no>
216+
- <Rationale if not applicable, otherwise link to filled out DFA>
217+
218+
| Development failure initiators
219+
| Section is **only applicable if a divers SW development is needed** due to decomposition.
220+
221+
:note: Section shall be applied only once to analyse all dependencies of the features. Results shall be checked during of the analysis of new features if this is applicable to the feature.
222+
223+
.. list-table:: DFA development failure initiators (Platform DFA)
224+
:header-rows: 1
225+
:widths: 10,20,10,20
226+
227+
* - ID
228+
- Violation cause development failure initiators
229+
- Applicability
230+
- Rationale
231+
* - SC_01_02
232+
- Same development approaches (e.g. IDE, programming and/or modelling language)
233+
- <yes | no>
234+
- <Rationale if not applicable, otherwise link to filled out DFA>
235+
* - SC_01_03
236+
- Same personal
237+
- <yes | no>
238+
- <Rationale if not applicable, otherwise link to filled out DFA>
239+
* - SC_01_04
240+
- Same social-cultural context (even if different personnel). Only applicable if diverse development is needed.
241+
- <yes | no>
242+
- <Rationale if not applicable, otherwise link to filled out DFA>
243+
* - SC_01_05
244+
- Development fault (e.g. human error, insufficient qualification, insufficient methods). Only applicable if diverse development is needed.
245+
- <yes | no>
246+
- <Rationale if not applicable, otherwise link to filled out DFA>
247+
248+
249+
DFA
250+
---
251+
For all identified applicable failure initiators, the DFA is performed in the following section.
252+
40253
.. code-block:: rst
41254
42255
.. feat_saf_dfa:: <Title>

‎process/folder_templates/features/feature_name/safety_analysis/fmea.rst‎

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,9 +34,86 @@ FMEA (Failure Modes and Effects Analysis)
3434
- Adjust ``status`` to be ``valid``
3535
- Adjust ``safety`` and ``tags`` according to your needs
3636

37+
The FMEA for the feature [Your Feature Name] is performed. To show evidence that all failure initiators are considered, the applicability has to be filled out in the
38+
following tables. For all applicable failure initiators, the FMEA has to be performed.
39+
3740
Failure Mode List
3841
-----------------
3942

43+
Fault Models for sequence diagrams
44+
.. list-table:: Fault Models for sequence diagrams
45+
:header-rows: 1
46+
:widths: 10,20,10,20
47+
48+
* - ID
49+
- Failure Mode
50+
- Applicability
51+
- Rationale
52+
* - MF_01_01
53+
- message is not received (is a subset/more precise description of MF_01_05)
54+
- <yes | no>
55+
- <Rationale if not applicable, otherwise link to filled out FMEA>
56+
* - MF_01_02
57+
- message received too late (only relevant if delay is a realistic fault)
58+
- <yes | no>
59+
- <Rationale if not applicable, otherwise link to filled out FMEA>
60+
* - MF_01_03
61+
- message received too early (usually not a problem)
62+
- <yes | no>
63+
- <Rationale if not applicable, otherwise link to filled out FMEA>
64+
* - MF_01_04
65+
- message not received correctly by all recipients (different messages or messages partly lost). Only relevant if the same message goes to multiple recipients.
66+
- <yes | no>
67+
- <Rationale if not applicable, otherwise link to filled out FMEA>
68+
* - MF_01_05
69+
- message is corrupted
70+
- <yes | no>
71+
- <Rationale if not applicable, otherwise link to filled out FMEA>
72+
* - MF_01_06
73+
- message is not sent
74+
- <yes | no>
75+
- <Rationale if not applicable, otherwise link to filled out FMEA>
76+
* - MF_01_07
77+
- message is unintended sent
78+
- <yes | no>
79+
- <Rationale if not applicable, otherwise link to filled out FMEA>
80+
* - CO_01_01
81+
- minimum constraint boundary is violated
82+
- <yes | no>
83+
- <Rationale if not applicable, otherwise link to filled out FMEA>
84+
* - CO_01_02
85+
- maximum constraint boundary is violated
86+
- <yes | no>
87+
- <Rationale if not applicable, otherwise link to filled out FMEA>
88+
* - EX_01_01
89+
- Process calculates wrong result(s) (is a subset/more precise description of MF_01_05 or MF_01_04). This failure mode is related to the analysis if e.g. internal safety mechanisms are required (level 2 function, plausibility check of the output, …) because of the size / complexity of the feature.
90+
- <yes | no>
91+
- <Rationale if not applicable, otherwise link to filled out FMEA>
92+
* - EX_01_02
93+
- processing too slow (only relevant if timing is considered)
94+
- <yes | no>
95+
- <Rationale if not applicable, otherwise link to filled out FMEA>
96+
* - EX_01_03
97+
- processing too fast (only relevant if timing is considered)
98+
- <yes | no>
99+
- <Rationale if not applicable, otherwise link to filled out FMEA>
100+
* - EX_01_04
101+
- loss of execution
102+
- <yes | no>
103+
- <Rationale if not applicable, otherwise link to filled out FMEA>
104+
* - EX_01_05
105+
- processing changes to arbitrary process
106+
- <yes | no>
107+
- <Rationale if not applicable, otherwise link to filled out FMEA>
108+
* - EX_01_06
109+
- processing is not complete (infinite loop)
110+
- <yes | no>
111+
- <Rationale if not applicable, otherwise link to filled out FMEA>
112+
113+
FMEA
114+
----
115+
For all identified applicable failure initiators, the FMEA is performed in the following section.
116+
40117
.. code-block:: rst
41118
42119

0 commit comments

Comments
 (0)