Results comp FMEA by aschemmel-tech · Pull Request #2879 · eclipse-score/score

aschemmel-tech · 2026-05-07T08:56:33Z

Refers: #2490

github-actions · 2026-05-07T08:56:44Z

⚠️ Docs-as-Code version mismatch detected
Please check the CI build logs for details and align the documentation version with the Bazel dependency.

github-actions · 2026-05-07T09:00:42Z

The created documentation from the pull request is available at: docu-html

Refers: #2490

4og

Needs review for result lib experts

mihajlo-k

Added some more context and some suggestions

mihajlo-k · 2026-05-11T07:54:34Z

+.. comp_saf_fmea:: Result Enum Type Mismatch
+   :violates: comp_arc_dyn__baselibs__result
+   :id: comp_saf_fmea__result__enum_type_mismatch
+   :fault_id: CO_01_01
+   :failure_effect: User would understand a wrong error type (based on different error domains)
+   :mitigation_issue: https://github.com/eclipse-score/score/issues/2880
+   :sufficient: no
+   :status: valid


Suggested change

.. comp_saf_fmea:: Result Enum Type Mismatch

:violates: comp_arc_dyn__baselibs__result

:id: comp_saf_fmea__result__enum_type_mismatch

:fault_id: CO_01_01

:failure_effect: User would understand a wrong error type (based on different error domains)

:mitigation_issue: https://github.com/eclipse-score/score/issues/2880

:sufficient: no

:status: valid

.. comp_saf_fmea:: Result Error Code Cross-Domain Misinterpretation

:violates: comp_arc_dyn__baselibs__result

:id: comp_saf_fmea__result__enum_type_mismatch

:fault_id: CO_01_01

:failure_effect: When retrieving error information, the error code is returned as a domain-agnostic integer. If the user interprets this code under a different error domain than the one that produced it, the error is misidentified, potentially leading to incorrect error reaction.

:mitigation_issue: https://github.com/eclipse-score/score/issues/2880

:sufficient: no

:status: valid

mihajlo-k · 2026-05-11T07:57:27Z

+   Only if the user would use the error information not only for debug reasons but for selecting the
+   type of error reaction this error may have an error impact. We need to make the user aware of this.


Suggested change

Only if the user would use the error information not only for debug reasons but for selecting the

type of error reaction this error may have an error impact. We need to make the user aware of this.

If the user relies on the error code not only for diagnostic purposes but for selecting an error reaction path, misinterpreting the code under a wrong domain could lead to an incorrect safety-relevant decision. An Assumption of Use shall ensure the user verifies the error domain before interpreting the error code.

mihajlo-k · 2026-05-11T07:59:41Z

+    * - CO_01_01
+      - minimum constraint boundary is violated
+      - yes
+      - Used enum types may not match - see :need:`comp_saf_fmea__result__enum_type_mismatch`


Suggested change

- Used enum types may not match - see :need:`comp_saf_fmea__result__enum_type_mismatch`

- The error code returned is not bound to a specific error domain at the type level. A user may interpret the code against the wrong domain, violating the constraint that error codes are only meaningful within their originating domain (see :need:`comp_saf_fmea__result__enum_type_mismatch`).

mihajlo-k · 2026-05-11T08:06:03Z

+.. comp_saf_fmea:: Result Error Message Unavailability
+   :violates: comp_arc_dyn__baselibs__result
+   :id: comp_saf_fmea__result__error_message_unavail
+   :fault_id: MF_01_05
+   :failure_effect: Accessing error message could result in undefined behaviour
+   :mitigated_by: aou_req__result__resource_lifetime
+   :mitigation_issue: https://github.com/eclipse-score/score/issues/2880
+   :sufficient: no
+   :status: valid


Suggested change

.. comp_saf_fmea:: Result Error Message Unavailability

:violates: comp_arc_dyn__baselibs__result

:id: comp_saf_fmea__result__error_message_unavail

:fault_id: MF_01_05

:failure_effect: Accessing error message could result in undefined behaviour

:mitigated_by: aou_req__result__resource_lifetime

:mitigation_issue: https://github.com/eclipse-score/score/issues/2880

:sufficient: no

:status: valid

.. comp_saf_fmea:: Result Error Message Lifetime Violation

:violates: comp_arc_dyn__baselibs__result

:id: comp_saf_fmea__result__error_message_unavail

:fault_id: MF_01_05

:failure_effect: The error message provided during error construction is stored as a non-owning reference. If the referenced data is no longer valid when the user retrieves the error message, accessing it results in undefined behavior.

:mitigated_by: aou_req__result__resource_lifetime

:mitigation_issue: https://github.com/eclipse-score/score/issues/2880

:sufficient: no

:status: valid

mihajlo-k · 2026-05-11T08:07:00Z

+   :sufficient: no
+   :status: valid
+
+   The linked AoU cares about unavailability of other return objects, but also the error message may be unavailable.


Suggested change

The linked AoU cares about unavailability of other return objects, but also the error message may be unavailable.

The existing Assumption of Use for resource lifetime addresses the validity of error domain objects and referenced resources. However, it does not explicitly cover the user-provided error message, which is equally subject to lifetime constraints. The AoU should be extended to explicitly include the error message data, or a separate AoU should be established for it.

mihajlo-k · 2026-05-11T08:08:31Z

+    * - MF_01_05
+      - message is corrupted
+      - yes
+      - Error message string is destroyed before accessing it by the user - see :need:`comp_saf_fmea__result__error_message_unavail`


Suggested change

- Error message string is destroyed before accessing it by the user - see :need:`comp_saf_fmea__result__error_message_unavail`

- The error message carried within the error object does not own the underlying data. If the data source is destroyed before the error message is accessed by the user, the message reference becomes invalid (see :need:`comp_saf_fmea__result__error_message_unavail`).

mihajlo-k · 2026-05-11T08:13:18Z

+.. comp_saf_fmea:: Result No Return
+   :violates: comp_arc_dyn__baselibs__result
+   :id: comp_saf_fmea__result__no_return
+   :fault_id: MF_01_06
+   :failure_effect: Accessing value object could result in undefined behaviour (e.g. usage of wrong value)
+   :mitigated_by: aou_req__result__value_handling, aou_req__result__error_reaction
+   :sufficient: yes
+   :status: valid


correction: effect is not UB, but deterministic termination.

also I don't think aou_req__result__error_reaction applies here, since it's rather about reacting to an error.

Suggested change

.. comp_saf_fmea:: Result No Return

:violates: comp_arc_dyn__baselibs__result

:id: comp_saf_fmea__result__no_return

:fault_id: MF_01_06

:failure_effect: Accessing value object could result in undefined behaviour (e.g. usage of wrong value)

:mitigated_by: aou_req__result__value_handling, aou_req__result__error_reaction

:sufficient: yes

:status: valid

.. comp_saf_fmea:: Result Unchecked Value or Error Access

:violates: comp_arc_dyn__baselibs__result

:id: comp_saf_fmea__result__no_return

:fault_id: MF_01_06

:failure_effect: If the user calls value without the result containing a value, or calls error without the result containing an error, the program will terminate. This may occur when the user does not check the state of the result before accessing it.

:mitigated_by: aou_req__result__value_handling

:sufficient: yes

:status: valid

mihajlo-k · 2026-05-11T08:22:19Z

+   If a value or a error is not returned this will be noticed by the user and reacted upon. This is ensured
+   additionally by the provided AoU.


Suggested change

If a value or a error is not returned this will be noticed by the user and reacted upon. This is ensured

additionally by the provided AoU.

If the user accesses the value or the error without first verifying the state of the result, the program will deterministically terminate. The provided Assumptions of Use require the user to check and handle both states before access.

mihajlo-k · 2026-05-11T08:30:02Z


-.. attention::
-    The above directive must be updated according to your component FMEA.
+.. comp_saf_fmea:: Result Stop User


Now when I think about this one it seems too generic. Any library accepting callbacks might suffer from this.

I would keep - we have a generic (platform level) AoU to cover this.

mihajlo-k · 2026-05-11T08:32:42Z

+    * - EX_01_05
+      - processing changes to arbitrary process
+      - no
+      - Not a problem of result lib as this is a libray and not a process


Suggested change

- Not a problem of result lib as this is a libray and not a process

- Not a problem of result lib as this is a library and not a process

mihajlo-k

Since we are keeping comp_saf_fmea__result__stop_user I would suggest some changes.

mihajlo-k · 2026-05-12T11:05:49Z

+.. comp_saf_fmea:: Result Stop User
+   :violates: comp_arc_dyn__baselibs__result
+   :id: comp_saf_fmea__result__stop_user
+   :fault_id: EX_01_06
+   :failure_effect: User could be stopped by a function provided as a result from another user
+   :mitigated_by: aou_req__platform__flow_monitoring
+   :sufficient: yes
+   :status: valid

-    - The above "code-block" directive must be updated
-    - Fill in all the needed information in the <brackets>
+   Stopping its own execution has to be managed by the user via program flow monitoring, see AoU.


I would keep - we have a generic (platform level) AoU to cover this.

In that case I would propose some changes that provide a bit more clarity:

Suggested change

.. comp_saf_fmea:: Result Stop User

:violates: comp_arc_dyn__baselibs__result

:id: comp_saf_fmea__result__stop_user

:fault_id: EX_01_06

:failure_effect: User could be stopped by a function provided as a result from another user

:mitigated_by: aou_req__platform__flow_monitoring

:sufficient: yes

:status: valid

- The above "code-block" directive must be updated

- Fill in all the needed information in the <brackets>

Stopping its own execution has to be managed by the user via program flow monitoring, see AoU.

.. comp_saf_fmea:: Result User-Provided Operation Blocks Execution

:violates: comp_arc_dyn__baselibs__result

:id: comp_saf_fmea__result__stop_user

:fault_id: EX_01_06

:failure_effect: The user provides a transformation or error handling operation to the Result library. If this operation does not terminate (e.g., infinite loop), the calling execution is blocked indefinitely.

:mitigated_by: aou_req__platform__flow_monitoring

:sufficient: yes

:status: valid

The Result library invokes user-provided operations synchronously during transformation of values or errors. Ensuring these operations terminate is outside the scope of the library and is the responsibility of the user via program flow monitoring, as covered by the referenced platform-level Assumption of Use.

mihajlo-k · 2026-05-12T11:06:59Z

+    * - EX_01_06
+      - processing is not complete (infinite loop)
+      - yes
+      - User gives back a function as return which induces stop of user execution - see :need:`comp_saf_fmea__result__stop_user`


Suggested change

- User gives back a function as return which induces stop of user execution - see :need:`comp_saf_fmea__result__stop_user`

- The Result library accepts user-provided operations for value and error transformation. If such an operation does not complete, the calling execution is halted (see :need:`comp_saf_fmea__result__stop_user`).

Refers: #2490

github-project-automation Bot added this to S-CORE Roadmap May 7, 2026

github-project-automation Bot moved this to Backlog in S-CORE Roadmap May 7, 2026

aschemmel-tech requested a review from 4og May 7, 2026 08:56

aschemmel-tech force-pushed the aschemmel-tech-results-fmea branch from b7763c2 to 51e76dc Compare May 7, 2026 15:01

Results comp FMEA

653a0a4

Refers: #2490

aschemmel-tech force-pushed the aschemmel-tech-results-fmea branch from 51e76dc to 653a0a4 Compare May 8, 2026 13:35

aschemmel-tech marked this pull request as ready for review May 8, 2026 13:36

aschemmel-tech requested a review from a team as a code owner May 8, 2026 13:36

aschemmel-tech requested review from mihajlo-k May 8, 2026 13:37

FScholPer previously approved these changes May 8, 2026

View reviewed changes

4og requested changes May 8, 2026

View reviewed changes

mihajlo-k reviewed May 11, 2026

View reviewed changes

aschemmel-tech dismissed FScholPer’s stale review via 5973b4a May 11, 2026 13:09

mihajlo-k reviewed May 12, 2026

View reviewed changes

Results comp FMEA - updates

7a44ace

Refers: #2490

aschemmel-tech force-pushed the aschemmel-tech-results-fmea branch from 5973b4a to 7a44ace Compare May 12, 2026 13:19

mihajlo-k approved these changes May 12, 2026

View reviewed changes

		Only if the user would use the error information not only for debug reasons but for selecting the
		type of error reaction this error may have an error impact. We need to make the user aware of this.

	Only if the user would use the error information not only for debug reasons but for selecting the
	type of error reaction this error may have an error impact. We need to make the user aware of this.
	If the user relies on the error code not only for diagnostic purposes but for selecting an error reaction path, misinterpreting the code under a wrong domain could lead to an incorrect safety-relevant decision. An Assumption of Use shall ensure the user verifies the error domain before interpreting the error code.

	- Used enum types may not match - see :need:`comp_saf_fmea__result__enum_type_mismatch`
	- The error code returned is not bound to a specific error domain at the type level. A user may interpret the code against the wrong domain, violating the constraint that error codes are only meaningful within their originating domain (see :need:`comp_saf_fmea__result__enum_type_mismatch`).

	The linked AoU cares about unavailability of other return objects, but also the error message may be unavailable.
	The existing Assumption of Use for resource lifetime addresses the validity of error domain objects and referenced resources. However, it does not explicitly cover the user-provided error message, which is equally subject to lifetime constraints. The AoU should be extended to explicitly include the error message data, or a separate AoU should be established for it.

	- Error message string is destroyed before accessing it by the user - see :need:`comp_saf_fmea__result__error_message_unavail`
	- The error message carried within the error object does not own the underlying data. If the data source is destroyed before the error message is accessed by the user, the message reference becomes invalid (see :need:`comp_saf_fmea__result__error_message_unavail`).

		If a value or a error is not returned this will be noticed by the user and reacted upon. This is ensured
		additionally by the provided AoU.

	If a value or a error is not returned this will be noticed by the user and reacted upon. This is ensured
	additionally by the provided AoU.
	If the user accesses the value or the error without first verifying the state of the result, the program will deterministically terminate. The provided Assumptions of Use require the user to check and handle both states before access.

	- Not a problem of result lib as this is a libray and not a process
	- Not a problem of result lib as this is a library and not a process

	- User gives back a function as return which induces stop of user execution - see :need:`comp_saf_fmea__result__stop_user`
	- The Result library accepts user-provided operations for value and error transformation. If such an operation does not complete, the calling execution is halted (see :need:`comp_saf_fmea__result__stop_user`).

Conversation

aschemmel-tech commented May 7, 2026

Uh oh!

github-actions Bot commented May 7, 2026

Uh oh!

github-actions Bot commented May 7, 2026

Uh oh!

4og left a comment

Choose a reason for hiding this comment

Uh oh!

mihajlo-k left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mihajlo-k left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants