Skip to content

Improve safety analysis templates #598

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
PandaeDo wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Improve safety analysis templates #598

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
ee7e56e
update safety analysis templates
PandaeDo Mar 4, 2026
f949b00
adopt failure inititor lists
PandaeDo Mar 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
138 changes: 138 additions & 0 deletions process/folder_templates/features/feature_name/safety_analysis/dfa.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,9 +34,147 @@ DFA (Dependent Failure Analysis)
- Adjust ``status`` to be ``valid``
- Adjust ``safety`` and ``tags`` according to your needs

The DFA for the feature [Your Feature Name] is performed. To show evidence that all failure initiators are considered, the applicability has to be filled out in the
following tables. For all applicable failure initiators, the DFA has to be performed.

Dependent Failure Initiators
----------------------------

2.1 Shared resources
Copy link
Contributor

@aschemmel-tech aschemmel-tech Mar 19, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

content missing?


| 2.2 Communication between the two elements:
| Receiving function is affected by information that is false, lost, sent multiple times, or in the wrong order etc. from the sender.

.. list-table:: DFA communication between elements
:header-rows: 1
:widths: 10,20,10,20

* - ID
- Violation cause communication between elements
- Applicability
- Rationale
* - CO_01_01
- Information passed via argument through a function call, or via writing/reading a variable being global to the two software functions (data flow)
- <yes | no>
- <Rationale if not applicable, otherwise link to filled out DFA>
* - CO_01_02
- Data or message corruption / repetition / loss / delay / masquerading or incorrect addressing of information
- <yes | no>
- <Rationale if not applicable, otherwise link to filled out DFA>
* - CO_01_03
- Insertion / sequence of information
- <yes | no>
- <Rationale if not applicable, otherwise link to filled out DFA>
* - CO_01_04
- Corruption of information, inconsistent data
- <yes | no>
- <Rationale if not applicable, otherwise link to filled out DFA>
* - CO_01_05
- Asymmetric information sent from a sender to multiple receivers, so that not all defined receivers have the same information
- <yes | no>
- <Rationale if not applicable, otherwise link to filled out DFA>
* - CO_01_06
- Information from a sender received by only a subset of the receivers
- <yes | no>
- <Rationale if not applicable, otherwise link to filled out DFA>
* - CO_01_07
- Blocking access to a communication channel
- <yes | no>
- <Rationale if not applicable, otherwise link to filled out DFA>

| 2.3 Shared information inputs
| Same information input used by multiple functions.

.. list-table:: DFA shared information inputs
:header-rows: 1
:widths: 10,20,10,20

* - ID
- Violation cause shared information inputs
- Applicability
- Rationale
* - SI_01_02
- Configuration data
- <yes | no>
- <Rationale if not applicable, otherwise link to filled out DFA>
* - SI_01_03
- Constants, or variables, being global to the two software functions
- <yes | no>
- <Rationale if not applicable, otherwise link to filled out DFA>
* - SI_01_04
- Basic software passes data (read from hardware register and converted into logical information) to two applications software functions
- <yes | no>
- <Rationale if not applicable, otherwise link to filled out DFA>
* - SI_01_05
- Data / function parameter arguments / messages delivered by software function to more than one other function
- <yes | no>
- <Rationale if not applicable, otherwise link to filled out DFA>

| 2.4 Unintended impact
| Unintended impacts to function due to various failures.

.. list-table:: DFA unintended impact
:header-rows: 1
:widths: 10,20,10,20

* - ID
- Violation cause unintended impact
- Applicability
- Rationale
* - UI_01_01
- Memory miss-allocation and leaks
- <yes | no>
- <Rationale if not applicable, otherwise link to filled out DFA>
* - UI_01_02
- Read/Write access to memory allocated to another software element
- <yes | no>
- <Rationale if not applicable, otherwise link to filled out DFA>
* - UI_01_03
- Stack/Buffer under-/overflow
- <yes | no>
- <Rationale if not applicable, otherwise link to filled out DFA>
* - UI_01_04
- Deadlocks
- <yes | no>
- <Rationale if not applicable, otherwise link to filled out DFA>
* - UI_01_05
- Livelocks
- <yes | no>
- <Rationale if not applicable, otherwise link to filled out DFA>
* - UI_01_06
- Blocking of execution
- <yes | no>
- <Rationale if not applicable, otherwise link to filled out DFA>
* - UI_01_07
- Incorrect allocation of execution time
- <yes | no>
- <Rationale if not applicable, otherwise link to filled out DFA>
* - UI_01_08
- Incorrect execution flow
- <yes | no>
- <Rationale if not applicable, otherwise link to filled out DFA>
* - UI_01_09
- Incorrect synchronization between software elements
- <yes | no>
- <Rationale if not applicable, otherwise link to filled out DFA>
* - UI_01_10
- CPU time depletion
- <yes | no>
- <Rationale if not applicable, otherwise link to filled out DFA>
* - UI_01_11
- Memory depletion
- <yes | no>
- <Rationale if not applicable, otherwise link to filled out DFA>
* - UI_01_12
- Other HW unavailability
- <yes | no>
- <Rationale if not applicable, otherwise link to filled out DFA>


DFA
---
For all identified applicable failure initiators, the DFA is performed in the following section.

.. code-block:: rst

.. feat_saf_dfa:: <Title>
Expand Down
77 changes: 77 additions & 0 deletions process/folder_templates/features/feature_name/safety_analysis/fmea.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,9 +34,86 @@ FMEA (Failure Modes and Effects Analysis)
- Adjust ``status`` to be ``valid``
- Adjust ``safety`` and ``tags`` according to your needs

The FMEA for the feature [Your Feature Name] is performed. To show evidence that all failure initiators are considered, the applicability has to be filled out in the
following tables. For all applicable failure initiators, the FMEA has to be performed.

Failure Mode List
-----------------

Fault Models for sequence diagrams
.. list-table:: Fault Models for sequence diagrams
:header-rows: 1
:widths: 10,20,10,20

* - ID
- Failure Mode
- Applicability
- Rationale
* - MF_01_01
- message is not received (is a subset/more precise description of MF_01_05)
- <yes | no>
- <Rationale if not applicable, otherwise link to filled out FMEA>
* - MF_01_02
- message received too late (only relevant if delay is a realistic fault)
- <yes | no>
- <Rationale if not applicable, otherwise link to filled out FMEA>
* - MF_01_03
- message received too early (usually not a problem)
- <yes | no>
- <Rationale if not applicable, otherwise link to filled out FMEA>
* - MF_01_04
- message not received correctly by all recipients (different messages or messages partly lost). Only relevant if the same message goes to multiple recipients.
- <yes | no>
- <Rationale if not applicable, otherwise link to filled out FMEA>
* - MF_01_05
- message is corrupted
- <yes | no>
- <Rationale if not applicable, otherwise link to filled out FMEA>
* - MF_01_06
- message is not sent
- <yes | no>
- <Rationale if not applicable, otherwise link to filled out FMEA>
* - MF_01_07
- message is unintended sent
- <yes | no>
- <Rationale if not applicable, otherwise link to filled out FMEA>
* - CO_01_01
- minimum constraint boundary is violated
- <yes | no>
- <Rationale if not applicable, otherwise link to filled out FMEA>
* - CO_01_02
- maximum constraint boundary is violated
- <yes | no>
- <Rationale if not applicable, otherwise link to filled out FMEA>
* - EX_01_01
- Process calculates wrong result(s) (is a subset/more precise description of MF_01_05 or MF_01_04). This failure mode is related to the analysis if e.g. internal safety mechanisms are required (level 2 function, plausibility check of the output, …) because of the size / complexity of the feature.
- <yes | no>
- <Rationale if not applicable, otherwise link to filled out FMEA>
* - EX_01_02
- processing too slow (only relevant if timing is considered)
- <yes | no>
- <Rationale if not applicable, otherwise link to filled out FMEA>
* - EX_01_03
- processing too fast (only relevant if timing is considered)
- <yes | no>
- <Rationale if not applicable, otherwise link to filled out FMEA>
* - EX_01_04
- loss of execution
- <yes | no>
- <Rationale if not applicable, otherwise link to filled out FMEA>
* - EX_01_05
- processing changes to arbitrary process
- <yes | no>
- <Rationale if not applicable, otherwise link to filled out FMEA>
* - EX_01_06
- processing is not complete (infinite loop)
- <yes | no>
- <Rationale if not applicable, otherwise link to filled out FMEA>

FMEA
----
For all identified applicable failure initiators, the FMEA is performed in the following section.

.. code-block:: rst


Expand Down
136 changes: 136 additions & 0 deletions ...older_templates/modules/module_name/component_name/docs/safety_analysis/dfa.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,9 +34,145 @@ DFA (Dependent Failure Analysis)
- Adjust ``status`` to be ``valid``
- Adjust ``safety`` and ``tags`` according to your needs

The DFA for the component [Your Component Name] is performed. To show evidence that all failure initiators are considered, the applicability has to be filled out in the
following tables. For all applicable failure initiators, the DFA has to be performed.

Dependent Failure Initiators
----------------------------

| 2.2 Communication between the two elements:
Copy link
Contributor

@aschemmel-tech aschemmel-tech Mar 19, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why is "2.1 Shared ressources" missing here?

Copy link
Contributor

@aschemmel-tech aschemmel-tech Mar 19, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I do not like the formatting, could we have headlines? And also that it starts the enumeration with "2".

| Receiving function is affected by information that is false, lost, sent multiple times, or in the wrong order etc. from the sender.

.. list-table:: DFA communication between elements
:header-rows: 1
:widths: 10,20,10,20

* - ID
- Violation cause communication between elements
- Applicability
- Rationale
* - CO_01_01
- Information passed via argument through a function call, or via writing/reading a variable being global to the two software functions (data flow)
- <yes | no>
- <Rationale if not applicable, otherwise link to filled out DFA>
* - CO_01_02
- Data or message corruption / repetition / loss / delay / masquerading or incorrect addressing of information
- <yes | no>
- <Rationale if not applicable, otherwise link to filled out DFA>
* - CO_01_03
- Insertion / sequence of information
- <yes | no>
- <Rationale if not applicable, otherwise link to filled out DFA>
* - CO_01_04
- Corruption of information, inconsistent data
- <yes | no>
- <Rationale if not applicable, otherwise link to filled out DFA>
* - CO_01_05
- Asymmetric information sent from a sender to multiple receivers, so that not all defined receivers have the same information
- <yes | no>
- <Rationale if not applicable, otherwise link to filled out DFA>
* - CO_01_06
- Information from a sender received by only a subset of the receivers
- <yes | no>
- <Rationale if not applicable, otherwise link to filled out DFA>
* - CO_01_07
- Blocking access to a communication channel
- <yes | no>
- <Rationale if not applicable, otherwise link to filled out DFA>

| 2.3 Shared information inputs
| Same information input used by multiple functions.

.. list-table:: DFA shared information inputs
:header-rows: 1
:widths: 10,20,10,20

* - ID
- Violation cause shared information inputs
- Applicability
- Rationale
* - SI_01_02
- Configuration data
- <yes | no>
- <Rationale if not applicable, otherwise link to filled out DFA>
* - SI_01_03
- Constants, or variables, being global to the two software functions
- <yes | no>
- <Rationale if not applicable, otherwise link to filled out DFA>
* - SI_01_04
- Basic software passes data (read from hardware register and converted into logical information) to two applications software functions
- <yes | no>
- <Rationale if not applicable, otherwise link to filled out DFA>
* - SI_01_05
- Data / function parameter arguments / messages delivered by software function to more than one other function
- <yes | no>
- <Rationale if not applicable, otherwise link to filled out DFA>

| 2.4 Unintended impact
| Unintended impacts to function due to various failures.

.. list-table:: DFA unintended impact
:header-rows: 1
:widths: 10,20,10,20

* - ID
- Violation cause unintended impact
- Applicability
- Rationale
* - UI_01_01
- Memory miss-allocation and leaks
- <yes | no>
- <Rationale if not applicable, otherwise link to filled out DFA>
* - UI_01_02
- Read/Write access to memory allocated to another software element
- <yes | no>
- <Rationale if not applicable, otherwise link to filled out DFA>
* - UI_01_03
- Stack/Buffer under-/overflow
- <yes | no>
- <Rationale if not applicable, otherwise link to filled out DFA>
* - UI_01_04
- Deadlocks
- <yes | no>
- <Rationale if not applicable, otherwise link to filled out DFA>
* - UI_01_05
- Livelocks
- <yes | no>
- <Rationale if not applicable, otherwise link to filled out DFA>
* - UI_01_06
- Blocking of execution
- <yes | no>
- <Rationale if not applicable, otherwise link to filled out DFA>
* - UI_01_07
- Incorrect allocation of execution time
- <yes | no>
- <Rationale if not applicable, otherwise link to filled out DFA>
* - UI_01_08
- Incorrect execution flow
- <yes | no>
- <Rationale if not applicable, otherwise link to filled out DFA>
* - UI_01_09
- Incorrect synchronization between software elements
- <yes | no>
- <Rationale if not applicable, otherwise link to filled out DFA>
* - UI_01_10
- CPU time depletion
- <yes | no>
- <Rationale if not applicable, otherwise link to filled out DFA>
* - UI_01_11
- Memory depletion
- <yes | no>
- <Rationale if not applicable, otherwise link to filled out DFA>
* - UI_01_12
- Other HW unavailability
- <yes | no>
- <Rationale if not applicable, otherwise link to filled out DFA>


DFA
---
For all identified applicable failure initiators, the DFA is performed in the following section.

.. code-block:: rst

.. comp_saf_dfa:: <Title>
Expand Down
Loading
Loading