AoU Status¶
The following table provides a mapping of all Assumptions of Use (AoUs) defined in the RTA-CAR Safety manual and the current status of their implementation, when applicable, on the RTA-SQF tool.
ID |
AoU Title |
Category |
Status |
Source |
Result |
Implemented Since |
Reject Reason |
|---|---|---|---|---|---|---|---|
$ETAS_RTACAR_SM_BSW 014 |
The return values of all functions must be checked by the calling code. Where the called function does not check the input parameters the calling code must ensure the values are within a valid range. |
BSW |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_BSW 015 |
The call to the DET module by the calling code must be handled in an appropriate manner. |
BSW |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_BSW 017 |
Each of the callout functions must be written to same ASIL level as the BSW module that makes the call to the defined callout. The BSW module which makes the call may not check the validity of the call values, so it must not be assumed that they have been checked for correctness. |
BSW |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_BSW 024 |
You must ensure that the particular elements for detecting and handling falsified network signals are rated for effectiveness and properly configured. |
BSW |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_BSW 050 |
You should refer to the manuals that come with your chosen MCAL for information on building the MCAL. |
BSW |
done |
RTA-CAR_V12.12.0_Safety_Manual |
rejected |
no meaningful automation possible |
|
$ETAS_RTACAR_SM_BSW 051 |
You must ensure that timing protection is implemented to catch execution overrun and manage the system following ECU’s safety concept. |
BSW |
done |
RTA-CAR_V12.12.0_Safety_Manual |
rejected |
no meaningful automation possible |
|
$ETAS_RTACAR_SM_BSW 054 |
You must ensure that falsified or corrupted signals are not used. |
BSW |
done |
RTA-CAR_V12.12.0_Safety_Manual |
rejected |
no meaningful automation possible |
|
$ETAS_RTACAR_SM_BSW 055 |
You must ensure that all required variables and inputs have been initialized to valid, appropriate values before they are used. |
BSW |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_BSW 056 |
You must ensure that signals where the required update is not performed or signals with an exceeded tolerated latency are not used. |
BSW |
done |
RTA-CAR_V12.12.0_Safety_Manual |
rejected |
no meaningful automation possible |
|
$ETAS_RTACAR_SM_BSW 057 |
If a module accepts a configuration pointer for post-build, you must ensure that a NULL value is used to indicate default behavior, or a valid configuration structure is provided. |
BSW |
done |
RTA-CAR_V12.12.0_Safety_Manual |
rejected |
no meaningful automation possible |
|
$ETAS_RTACAR_SM_BSW 058 |
You must ensure that the execution of falsified or corrupted I/O (input/output) signals is avoided. |
BSW |
done |
RTA-CAR_V12.12.0_Safety_Manual |
rejected |
no meaningful automation possible |
|
$ETAS_RTACAR_SM_BSW 059 |
If a module depends on configuration values that influence its execution rate, you must ensure that these values are consistent across all related elements |
BSW |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_GEN 001 |
You must ensure that 3rd party code does not interfere with RTA-CAR generated code and therefore such modules should be developed according to an ISO 26262:2018 compliant development process with a compatible ASIL level. |
GEN |
done |
RTA-CAR_V12.12.0_Safety_Manual |
rejected |
no meaningful automation possible |
|
$ETAS_RTACAR_SM_GEN 002 |
Trusted partitions should only contain software with the highest ASIL. |
GEN |
done |
RTA-CAR_V12.12.0_Safety_Manual |
rejected |
no meaningful automation possible |
|
$ETAS_RTACAR_SM_GEN 004 |
You must decide what ASIL is appropriate for your ECU system. |
GEN |
done |
RTA-CAR_V12.12.0_Safety_Manual |
rejected |
no meaningful automation possible |
|
$ETAS_RTACAR_SM_GEN 005 |
You must ensure that your ECU system development process follows the ISO 26262:2018 recommendations for your chosen ASIL. |
GEN |
done |
RTA-CAR_V12.12.0_Safety_Manual |
rejected |
no meaningful automation possible |
|
$ETAS_RTACAR_SM_GEN 006 |
You must ensure that a technical safety concept (TSC) is developed and verified in accordance with ISO 26262-4:2018. The TSC provides evidence why the system is suitable to fulfill safety requirements resulting from activities described in ISO 26262-3:2018. |
GEN |
done |
RTA-CAR_V12.12.0_Safety_Manual |
rejected |
no meaningful automation possible |
|
$ETAS_RTACAR_SM_GEN 007 |
If Software Safety Requirements (SSRs) are allocated to RTA-CAR, you must ensure that SSRs are verified under consideration of Assumption of Use specified in this Safety Manual, and limits, and extensions specified in the User Manual, and Reference Guides. |
GEN |
done |
RTA-CAR_V12.12.0_Safety_Manual |
rejected |
no meaningful automation possible |
|
$ETAS_RTACAR_SM_GEN 008 |
You must handle error conditions indicated by RTA-CAR generated code in accordance with the system safety concept. |
GEN |
done |
RTA-CAR_V12.12.0_Safety_Manual |
rejected |
no meaningful automation possible |
|
$ETAS_RTACAR_SM_GEN 009 |
You must ensure that the ECU hardware is designed and configured according to ISO 26262-5:2018 such that the RTA-CAR generated code can assume complete reliability based on your defined safety concept. |
GEN |
done |
RTA-CAR_V12.12.0_Safety_Manual |
rejected |
no meaningful automation possible |
|
$ETAS_RTACAR_SM_GEN 010 |
You must ensure that any potential hardware faults which could prevent the correct operation of the RTA-CAR generated code are mitigated as part of the item design. |
GEN |
done |
RTA-CAR_V12.12.0_Safety_Manual |
rejected |
no meaningful automation possible |
|
$ETAS_RTACAR_SM_GEN 011 |
You must ensure that the detection of any hardware faults are available within the fault detection time interval (FDTI) allocated to the ECU under consideration to bring the ECU or system to a defined state according to the safety concept. |
GEN |
done |
RTA-CAR_V12.12.0_Safety_Manual |
rejected |
no meaningful automation possible |
|
$ETAS_RTACAR_SM_GEN 012 |
You must ensure that sufficient resources (ROM/RAM/runtime etc.) are available for the RTA-CAR generated code as configured for your safety relevant item. |
GEN |
done |
RTA-CAR_V12.12.0_Safety_Manual |
rejected |
no meaningful automation possible |
|
$ETAS_RTACAR_SM_GEN 013 |
You must ensure that runtime violations of any task exceeding the tolerated value are identified by watchdog or OS monitoring, and a reaction is triggered to bring the ECU or system to a defined state within the allocated fault handling time interval (FHTI) according to the safety concept. |
GEN |
done |
RTA-CAR_V12.12.0_Safety_Manual |
rejected |
no meaningful automation possible |
|
$ETAS_RTACAR_SM_GEN 014 |
You must ensure that the configured product features are used in a manner that respects the guidance and recommendations set out in the product documentation. |
GEN |
done |
RTA-CAR_V12.12.0_Safety_Manual |
rejected |
no meaningful automation possible |
|
$ETAS_RTACAR_SM_GEN 016 |
You must ensure that callback, callout, system-wide and OS-Application specific hook functions are correctly and consistently specified considering any restrictions defined in in the product documentation, implemented, and reviewed applying an ISO 26262:2018 compliant development process according to an appropriate ASIL of the system in line with the TSC. |
GEN |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_GEN 019 |
You must ensure that integration testing is performed according to ISO 26262-6:2018 clause 10. |
GEN |
done |
RTA-CAR_V12.12.0_Safety_Manual |
rejected |
no meaningful automation possible |
|
$ETAS_RTACAR_SM_GEN 020 |
You must ensure that the impact of incorrect code execution or improper CPU safety on the item safety goals is analyzed. |
GEN |
done |
RTA-CAR_V12.12.0_Safety_Manual |
rejected |
no meaningful automation possible |
|
$ETAS_RTACAR_SM_GEN 022 |
You must verify that all Technical Safety Requirements where RTA-CAR generated code is involved are met, see ISO 26262-4:2018 clause 7. |
GEN |
done |
RTA-CAR_V12.12.0_Safety_Manual |
rejected |
no meaningful automation possible |
|
$ETAS_RTACAR_SM_GEN 024 |
You must ensure that your toolchain including RTA-CAR is evaluated with respect to safety impact, prevention or detection measures during development process according to ISO 26262-8:2018, clause 11. |
GEN |
done |
RTA-CAR_V12.12.0_Safety_Manual |
rejected |
no meaningful automation possible |
|
$ETAS_RTACAR_SM_GEN 026 |
You must ensure that the RTA-CAR generated code can be compiled and linked with the rest of your ECU application without errors, and that any warnings raised during the compilation process are examined and understood. |
GEN |
done |
RTA-CAR_V12.12.0_Safety_Manual |
rejected |
no meaningful automation possible |
|
$ETAS_RTACAR_SM_GEN 027 |
You must ensure that the generated code integrated into your target system is checked for MISRA-C:2012 compliance or similar, and that the justifications for any deviations provided in each components MISRA compliance documentation are valid for your context of use. |
GEN |
done |
RTA-CAR_V12.12.0_Safety_Manual |
rejected |
no meaningful automation possible |
|
$ETAS_RTACAR_SM_GEN 029 |
You must verify that the PC environment you are using is suitable for executing the tools of RTA-CAR. |
GEN |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_GEN 030 |
You must ensure that you review issues reported in the Release Notes and KIRs. If they apply to your usage of RTA-CAR, you must apply the avoidance or workaround measures. |
GEN |
done |
RTA-CAR_V12.12.0_Safety_Manual |
rejected |
no meaningful automation possible |
|
$ETAS_RTACAR_SM_GEN 031 |
You must not use the prefixes of the reserved AUTOSAR namespaces defined in AUTOSAR: List of Basic Software Modules (R23-11), and the namespaces “rba_<yyy>” for symbols associated with any other software module or component. |
GEN |
done |
RTA-CAR_V12.12.0_Safety_Manual |
accepted |
0.2 |
|
$ETAS_RTACAR_SM_GEN 035 |
You must check any errors or warnings generated during the code generation stage and resolve any identified issues. |
GEN |
done |
RTA-CAR_V12.12.0_Safety_Manual |
rejected |
no meaningful automation possible |
|
$ETAS_RTACAR_SM_GEN 036 |
If your system uses memory protection, you must ensure that the MPU is correctly programmed with regard to user-defined memory to implement a “Freedom from Interference” scheme. |
GEN |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_GEN 037 |
You must ensure that the ECU configuration meets your system design, system requirements incl. TSRs, and supports your safety case. |
GEN |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_GEN 038 |
You must ensure that generated interfaces are used correctly. |
GEN |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_GEN 039 |
You must ensure that any downstream tools do not compromise the correctness of the generated code. |
GEN |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_GEN 040 |
You must ensure that all return values from generated APIs that return errors are handled appropriately. |
GEN |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_GEN 041 |
You must ensure that the C start-up code does initialize defined data sections and registers correctly before the “OS_MAIN()” function is called. |
GEN |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_GEN 042 |
You must ensure that the embedded software is tested according to ISO 26262-6:2018, clause 11. |
GEN |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_GEN 043 |
You must spot check that the memory allocation is plausible. |
GEN |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_GEN 044 |
You must spot check the alignment of addresses between A2L and compiler/linker. |
GEN |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_GEN 045 |
You must provide confidence in the use of external tools involved into RTA-CAR configuration and code compilation. |
GEN |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_GEN 046 |
You must spot check the output of external tools. |
GEN |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_GEN 047 |
You must ensure that the usage of exported data is analyzed and the impact of erroneous export data and detection and containment measures are determined. |
GEN |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_GEN 048 |
If you have a system with availability requirements, but designed on homogenous software redundancy, it is required that a sufficient independence between the elements that implement the corresponding redundant safety requirements may be claimed alternatively by performing a dependent failure analysis (DFA). |
GEN |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_GEN 049 |
You must ensure that the detection and reaction of indicated error conditions remain active in productive code. It is not allowed that the error handling is switched off within the configuration of RTA-CAR components. |
GEN |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_GEN 050 |
RTA-CAR generated software is designed to be used without modification. You must ensure that any modifications do not impact the safety case for the ECU. Any such modifications are out of the scope of RTA-CAR and this safety manual. |
GEN |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_GEN 051 |
If Post Build features are used, you must ensure that all AoU of this Safety Manual remain valid for all variants. |
GEN |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_GEN 052 |
If the memory of your microcontroller hardware uses data cache methods, you must ensure data coherence within the system. |
GEN |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_GEN 053 |
If OsApplications are used to partition SWCs with different ASIL levels or QM software, you must ensure that your software architecture enforces FFI by preventing improper use of interfaces and/or ensuring there are appropriate mitigation mechanisms. |
GEN |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_GEN 054 |
If you make use of splitting RTA-CAR software units, you must ensure to comply with the by ETAS provided architectural design guidelines, described at ETAS GmbH: RTA-CAR 12.11.0 User Guide chapter “BSW Multi-Core Distribution Strategies”. |
GEN |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_GEN 055 |
If your software directly interacts with RTA-CAR generated code that is assigned the highest ASIL level, you must ensure that your software is developed and verified following an ISO 26262:2018 compliant safety process for the ASIL level applied to the RTA-CAR generated code. |
GEN |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_GEN 056 |
If “Generation of ASW code frames” is used, you must review and test your functions implemented inside the generated ASW code frames. |
GEN |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_GEN 057 |
You must ensure that there is a concept for memory allocation and memory protection where required, to ensure FFI. |
GEN |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_GEN 058 |
You must ensure that all type definitions (e.g., in “Std_Types.h, ComStack_Types.h”) are consistent across all SWCs and BSW modules to enforce API and type consistency throughout the ECU. |
GEN |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_GEN 059 |
If ARXML files used by RTA-CAR are modified outside of RTA-CAR, you must ensure that those ARXML files remain conform to the applicable ARXML schema. |
GEN |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_GEN 060 |
If RTA-CAR generated code is part of a safety-related data path or control path, you must analyze within the system-specific fault model the effects of faults in the data and control flow handled by that generated code and crossing its interfaces. |
GEN |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_GEN 061 |
If fault detection or mitigation mechanisms are implemented by, or rely on, RTA-CAR generated code, you must assess their suitability within the system-specific fault model and technical safety concept, including their intended effect, assumptions, limitations, fault coverage, and fault reaction timing. |
GEN |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_GEN 062 |
You must verify that the detection and mitigation mechanisms associated with each identified fault are sufficient to achieve the required diagnostic coverage for the applicable ASIL and to operate within the FTTI. |
GEN |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_GEN 063 |
You must ensure that all periodic and event-driven runnable entities get scheduled and triggered, such that the required functional and safety-related timing constraints are met. |
GEN |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 004 |
You must ensure that the chosen microcontroller is compatible with those used by ETAS in the release testing of RTA-OS. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 005 |
You must use a compiler that is documented by the relevant RTA-OS Port Guide as being specifically supported by the generated-OS or one that has been validated as being compatible with it. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 007 |
The AUTOSAR release configured in RTA-OS shall be of a compatible release of AUTOSAR that is used for all other aspects of the system. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 008 |
You must ensure that RTA-OS has been configured to generate the OS for the correct target port, microcontroller and OS version. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 009 |
You must ensure that the Scalability Class (SC1 … SC4) is configured in a way that meets the system requirements and the safety concept. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 011 |
If scalability classes SC3 or SC4 are used, you should ensure that error checking with status “EXTENDED” is used during development phase to get a detailed understanding of applied error codes. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 012 |
You must ensure that the “tick” interrupt entry in the microcontroller vector table is the same as that configured for RTA-OS. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 013 |
You must ensure that a suitable free-running peripheral counter or hardware timer exists on the microcontroller or its associated peripherals that can generate the “advance” interrupt required by the RTA-OS hardware counter. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 014 |
You must ensure that the “advance” interrupt entry in the microcontroller vector table is the same as that configured for RTA-OS. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 017 |
If explicit synchronization of schedule tables is used, you must ensure that the duration of the schedule tables is equal to the “MAXALLOWEDVALUE + 1” of the synchronization counters. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 018 |
If extended tasks are used, you must ensure that for every CPU core the stack size has been specified for all tasks with a lower priority than the highest priority extended task. |
OS |
done |
RTA-CAR_V12.12.0_Safety_Manual |
accepted |
1.0.0 |
|
$ETAS_RTACAR_SM_OS 019 |
You must ensure that there is a complete mapping between events and the tasks that wait for them. |
OS |
done |
RTA-CAR_V12.12.0_Safety_Manual |
accepted |
1.1.0 |
|
$ETAS_RTACAR_SM_OS 024 |
You must ensure that time monitoring is correctly configured if you wish to use it. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 025 |
You must ensure that passive timing protection is correctly configured if you wish to use it. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 026 |
You must ensure that active timing protection is correctly configured if you wish to use it. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 027 |
You must ensure that the execution budget has been correctly set for all tasks and category 2 ISRs. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 028 |
If there is a requirement to customize the response of the generated-OS to any timing fault that is detected using either passive timing protection, or active timing protection, you must ensure that the protection hook function has been enabled. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 029 |
You must ensure that the timing model for the safety-related system will allow all the tasks and ISRs to meet their real-time deadlines at runtime. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 030 |
You must provide a mechanism to recover from a serious timing problem in the safety-related system that is independent of the generated-OS. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 031 |
If memory protection features are used in the system, you must ensure that the chosen microcontroller will prevent the MPU control registers being reprogrammed by code executing in non-privileged mode. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 032 |
If memory protection features are used in the system, you must ensure that the chosen microcontroller provides an MPU that can provide the memory protection mechanisms that are required. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 033 |
You must ensure that all the systems hardware and software components cooperate to provide a safe solution, and that trusted software components, such as AUTOSAR BSW, do not cause any interference problems. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 034 |
You must ensure that any trusted OS-Applications are correctly configured. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 035 |
You must ensure that any trusted-with-protection OS-Applications are correctly configured. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 036 |
You must ensure that any untrusted OS-Applications are correctly configured as being untrusted. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 038 |
You must ensure that the list of trusted functions that an OS-Application wishes to share with other OS-Applications is correct. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 040 |
If any untrusted OS-Applications are defined and a higher level of isolation is needed, the enhanced isolation feature must be used. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 041 |
You should ensure that the generated-OS does not support alarm callback functions in SC2, SC3 or SC4. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 042 |
If customized exception handling is required, you must ensure the protection hook function has been enabled. |
OS |
done |
RTA-CAR_V12.12.0_Safety_Manual |
accepted |
||
$ETAS_RTACAR_SM_OS 043 |
You must ensure that the ISRs for any exceptions that are to be handled independently of the generated-OS are correctly configured. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 044 |
You must ensure that all the ISRs are correctly configured. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 045 |
You must ensure that all unused interrupts that are raised unexpectedly are handled correctly and that this either leads to the safety-related ECU or system entering a defined state or to its continued correct operation according to the safety concept. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 046 |
You must ensure that an interrupt vector table is available. |
OS |
done |
RTA-CAR_V12.12.0_Safety_Manual |
accepted |
||
$ETAS_RTACAR_SM_OS 047 |
If centralized error handling is required, you must ensure that the system-wide error hook function has been enabled. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 048 |
You must ensure that the OS-Application specific error hook function has been correctly enabled for all the OS-Applications that should use it. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 050 |
You should ensure that the “Os_Cbk_GetAbortStack()” callback function is enabled if the protection hook has been enabled. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 051 |
You should ensure that stack monitoring is used and that all tasks and category 2 ISRs have valid execution budgets. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 052 |
You must ensure that any peripheral areas that are configured in the safety-related system accurately identify the registers of peripherals that should be accessed by the generated-OS on behalf of some OS-Application. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 053 |
You should ensure that any peripheral areas that are configured in the safety-related system accurately identify the OS-Applications that are allowed to access them. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 054 |
You must ensure that any OS-Applications that are allowed to access a peripheral area really do need this access and that steps have been taken to ensure that these OS-Applications cannot cause the violation of a safety goal by accidentally or deliberately misusing this access. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 055 |
You must ensure that any register sets that are configured in the safety-related system accurately identify the ISRs that use them. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 056 |
You must ensure that any register sets that are configured in the safety-related system accurately identify the tasks that use them. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 057 |
You must ensure that the type of any resources that are configured in the safety-related system has been correctly specified. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 058 |
You must ensure that any resources that are configured in the safety-related system accurately identify the ISRs that use them. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 059 |
You must ensure that any resources that are configured in the safety-related system accurately identify the tasks that use them. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 060 |
You must ensure that any spinlocks that are configured in the safety-related system accurately identify the locking method that is to be used to lock them. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 061 |
You must ensure that any spinlocks that are configured in the system which can be nested have their locking order configured using the “Successor Spinlock” option. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 062 |
You must enable the unchecked spinlock family of APIs if there is a need to access spinlocks from category 1 ISRs. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 063 |
You must ensure that any spinlocks that are configured in the safety-related system that can be accessed by category 1 ISRs use a locking method that locks all other interrupts. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 064 |
You must ensure that usage metrics are only collected by the generated-OS during system testing and not in a production system. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 067 |
You must not compile the source code for the generated-OS independently of RTA-OS. It is for debugging and validation purposes only. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 068 |
You must integrate RTA-OS into the build process for the safety-related system to ensure that the generated-OS library is included in the final application executable. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 069 |
You must not modify the library that is generated by RTA-OS because of the compilation process, and any downstream tools in the development process must not compromise the correctness of the library that is generated by RTA-OS. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 080 |
You must ensure that the “OS_MAIN()” function always calls the “Os_InitializeVectorTable()” API before it calls the “StartOS()” API even if a vector table is not automatically generated by RTA-OS. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 081 |
You must ensure that the “OS_MAIN()” function initializes all the necessary microcontroller registers before it calls the “StartOS()” API. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 082 |
You must ensure that the “OS_MAIN()” function only ever calls the “StartNonAutosarCore()” API to start those cores in a multicore system that are not using the generated-OS. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 083 |
You must ensure that the “OS_MAIN()” function calls the “StartCore()” API to start every core in a multicore system that is using the generated-OS. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 084 |
You must ensure that the “OS_MAIN()” function calls the “StartOS()” API to start the generated-OS on every core in a single core or multicore system that is using it. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 085 |
You must ensure that the “OS_MAIN()” function uses a valid mode parameter when it calls the “StartOS()” API in multicore systems. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 086 |
You must ensure that the microcontroller registers described in the relevant RTA-OS Port Guide are not altered after the “StartOS()” API has been called. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 087 |
You must ensure that no safety goal will be violated if the generated-OS is not shut down when an untrusted OS-Application calls the “ShutdownOS()” API. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 088 |
You must ensure that no safety goal will be violated if the generated-OS is not shut down when an untrusted OS-Application calls the “ShutdownAllCores()” API. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 089 |
You must ensure that “Os_SetRestartPoint()” API was called before the “StartOS()” API if the “Os_Restart()” API is to be used to restart the generated-OS. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 090 |
You must ensure that the “Os_Restart()” API is called on every core on which the generated-OS is executing to restart a multicore system. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 091 |
You must ensure that a suitable hardware timer exists on the microcontroller and that it has been programmed to provide suitable “tick” or “advance” interrupts to drive the counters, alarms, and schedule tables, which have been configured in the safety-related system. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 092 |
You must ensure that the driver for the hardware counter is written in a manner that is consistent with the chosen ASIL, is implemented correctly, and is tested in accordance with ISO 26262:2018. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 093 |
You must ensure that the hardware timer used to provide the “tick” interrupt is not unexpectedly reprogrammed at runtime. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 094 |
You must ensure that the “IncrementCounter()” API or its variants is not called from unexpected places in the system. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 095 |
If the synchronization of counters, alarms, or schedule tables, is important to the correct operation of the system, you must ensure that the system maintains the synchronization of counters/alarms and schedule tables at runtime. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 096 |
If implicit synchronization of schedule tables is used, you must always start the schedule tables at a known counter value. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 097 |
If explicit synchronization of schedule tables is used, you must ensure that appropriate synchronization counters and drive counters have been chosen. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 098 |
If explicit synchronization of schedule tables is used, you must ensure that each explicitly synchronized schedule table has the same modulus as its synchronization counter. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 099 |
If explicit synchronization of schedule tables is used, you must ensure that one tick of a drive counter takes the same time as one tick of the associated synchronization counter. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 100 |
If explicit synchronization of schedule tables is used, you must ensure that the correct functioning of schedule tables is set up by the system. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 101 |
You must ensure that the correct sequence of API calls is used when switching schedule tables at runtime. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 102 |
If extended tasks are used, you must ensure that all extended tasks are implemented as endless loops. |
OS |
done |
RTA-CAR_V12.12.0_Safety_Manual |
accepted |
1.1.0 |
|
$ETAS_RTACAR_SM_OS 103 |
If extended tasks are used, you must ensure that the use of extended tasks does not lead to a deadlock in the system at runtime. |
OS |
done |
RTA-CAR_V12.12.0_Safety_Manual |
accepted |
1.1.0 |
|
$ETAS_RTACAR_SM_OS 104 |
You must ensure that any sets of tasks that are passed to the delayed task APIs only contain tasks that will execute on the core on which the API is called. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 105 |
You must ensure that any set of tasks that is passed to a delayed task API contains either all the tasks on that core that share the same priority, or it must contain none of them. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 106 |
You must ensure that the hardware timer that is used by the get stopwatch callback function has sufficient accuracy and longevity to allow the generated-OS to accurately report the amount of time a category 2 ISR or task has spent executing, and to allow it, where necessary, to reliably detect when a task or category 2 ISR has exceeded its execution budget. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 107 |
You must ensure that a suitable get stopwatch callback function has been provided. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 108 |
If active timing protection is applied, you must ensure that an appropriate hardware timer is used to generate interrupts for active timing protection. It must be configured to accurately and reliably generate the interrupt at the correct times in order for the generated-OS to monitor the execution budgets of tasks and category 2 ISRs. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 109 |
If active timing protection is applied, you must ensure that a suitable set time limit callback function has been provided. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 110 |
If active timing protection is applied, you must ensure that a suitable suspend time limit callback function has been provided. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 111 |
If active timing protection is applied, you must ensure that a suitable category 1 ISR has been implemented to handle any active timing protection interrupt that is raised. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 112 |
If time monitoring is used, you must ensure that a suitable implementation of the time overrun hook function has been provided. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 113 |
If passive or active timing protection is used, you must ensure that a suitable implementation of the protection hook function has been provided. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 114 |
You must ensure that the functionality that has been provided to support time monitoring or timing protection has been thoroughly tested to ensure that the generated-OS is able to correctly police the execution budgets of tasks and category 2 ISRs. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 115 |
You must develop a consistent memory protection scheme that uses the microcontroller and the associated MPU to meet the needs of the safety-related system. This is because the generated-OS does not program the MPU directly. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 116 |
You must ensure that the linker control file that is being used places any sections in such a way that the memory protection scheme that has been devised is feasible and that it will meet the needs of the safety-related system. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 117 |
You must ensure that the MPU is initialized before the generated-OS is started and that this is done in a manner that is consistent with the memory protection scheme that has been devised. This is necessary because the generated-OS does not program the MPU directly. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 118 |
You must ensure that the MPU is re-programmed using memory locations and register settings that are consistent with the memory protection scheme that has been devised whenever the generated-OS performs a context switch. This is necessary because the generated-OS does not program the MPU directly. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 119 |
You must ensure that it is possible to accurately identify the access permissions that the MPU is imposing on an ISR or task when it tries to access a given memory region. This is necessary because the generated-OS does not program the MPU directly. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 120 |
You must ensure that it is possible to enable and disable the MPU when switching to and from OS-Applications that have been configured as trusted-with-protection. This is necessary because the generated-OS does not program the MPU directly. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 121 |
You must ensure that the memory protection scheme that has been devised does not lead to unexpected side effects due to tasks or ISRs in an OS-Application being able to manipulate objects in other OS-Applications in such a way that a safety-goal may be violated. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 122 |
You must ensure that the memory protection scheme that has been devised has been thoroughly tested. This is because it plays a crucial role in ensuring that untrusted OS-Applications and trusted-with-protection OS-Applications cannot easily compromise system safety. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 123 |
You must ensure that any task or ISR that is in a trusted OS-Application cannot cause system safety problems by writing to the wrong memory or unexpectedly changing peripheral registers. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 124 |
You must ensure that any task or ISR that is in a trusted-with-protection OS-Application respects the limitations associated with running in privileged mode and with its access to the system memory map restricted by the MPU. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 125 |
You must ensure that any task or ISR that is in an untrusted OS-Application respects the limitations associated with running in non-privileged mode and with its access to the system memory map restricted by the MPU. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 126 |
You must ensure that any trusted functions cannot perform any actions that will compromise system safety when they are called from untrusted OS-Applications. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 127 |
You must ensure that no trusted or trusted-with-protection OS-Application interferes with the generated-OS, regardless of whether this is by modifying any microcontroller registers that is under its control, or by modifying any data that is under its control, or by any other means. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 128 |
You must ensure that no trusted or trusted-with-protection OS-Application interferes with any other OS-Application, regardless of whether it is trusted, trusted-with-protection, or untrusted. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 129 |
You must ensure that there is no possibility of a safety goal being violated if the “TerminateApplication()” API is used to terminate any OS-applications. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 130 |
You must ensure that there is no possibility of a safety goal being violated if the “TerminateApplication()” API is unable to immediately terminate an OS-Application that is running on a different core to the one on which the API was called. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 131 |
If enhanced isolation is used, you must ensure that a suitable “Os_Cbk_IsSystemTrapAllowed()” callback function has been provided. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 132 |
If enhanced isolation is used, you must ensure that a suitable “Os_Cbk_IsUntrustedCodeOK()” callback function has been provided. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 133 |
If enhanced isolation is used, you must ensure that a suitable “Os_Cbk_IsUntrustedTrapOK()” callback function has been provided. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 134 |
If enhanced isolation is used, you must ensure that a suitable “Os_Cbk_RestoreGlobalRegisters()” callback function has been provided. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 135 |
If enhanced isolation is used, you must ensure that suitable implementations have been provided of any callback functions that are required by the relevant RTA-OS Port Guide. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 136 |
If alarm callback functions are used, you must ensure that they do not do anything that will compromise system safety. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 137 |
You must ensure that the handlers for any exceptions that are being handled independently of the generated-OS have been declared using the appropriate macro. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 138 |
You must ensure that the handlers for any exceptions that are being handled independently of the generated-OS have been correctly terminated. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 140 |
You must ensure that the handlers for any interrupts that are being handled by category 1 ISRs have been declared using the appropriate macro. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 141 |
You must ensure that the handlers for any interrupts that are being handled by category 1 ISRs have been correctly terminated. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 142 |
You must ensure that the handlers for any interrupts that are being handled by category 2 ISRs have been declared using the appropriate macro. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 143 |
You must ensure that the handlers for any interrupts that are being handled by category 2 ISRs have been correctly terminated. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 144 |
You must ensure that all unused interrupts that are raised unexpectedly are handled correctly and that this either leads to the safety-related ECU or system is entering a defined state or continues correct operation according to the safety concept. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 145 |
You must ensure that the “DisableInterruptSource()” API is not called to disable an interrupt that cannot be disabled. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 146 |
You must ensure that the “ClearPendingInterrupt()” API is not called to clear the pending status of an interrupt whose state cannot be changed. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 147 |
You must ensure that the “EnableInterruptSource()” API is not called to clear the pending status of an interrupt whose state cannot be changed. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 148 |
You must ensure that if OS-Applications can be terminated a suitable disable ISR callback function has been defined for every ISR that an OS-Application owns. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 149 |
You must ensure that if OS-Applications can be terminated a suitable terminated ISR callback function has been defined for every ISR that an OS-Application owns. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 151 |
You must ensure the runtime error detection facilities of RTA-OS are used appropriately. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 152 |
You must ensure that any error hook function that has been implemented has been written in a manner that is consistent with the chosen ASIL, is implemented correctly, and where possible, is used as an OS-Application specific error hook function rather than as a system-wide error hook. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 153 |
You must ensure that any protection hook function that has been implemented has been written in a manner that is consistent with the chosen ASIL, is implemented correctly, and is tested in accordance with ISO 26262:2018. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 155 |
If any stack overrun hook function is used, you must ensure that it has been implemented correctly and tested in accordance with ISO 26262:2018 and the chosen ASIL. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 156 |
If any time overrun hook function is used, you must ensure that it has been implemented correctly and tested in accordance with ISO 26262:2018 and the chosen ASIL. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 157 |
You must ensure that testing and checking of the systems hardware components is performed independently of the generated-OS and that an action that is appropriate to the safety concept is performed upon the detection of a fault. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 161 |
You must ensure that sufficient storage space has been allocated for any register sets that are configured in the safety-related system. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 162 |
You must ensure that for each register set that is configured in the safety-related system an appropriate callback function to save each register in the set has been defined. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 163 |
You must ensure that for each register set that is configured in the safety-related system an appropriate callback function to restore each register in the set has been defined. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 164 |
You must ensure that the use of spinlocks does not lead to a deadlock occurring at runtime. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 165 |
You must ensure that the “UncheckedGetSpinlock()” API of the generated-OS is only called by category 1 ISRs. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 166 |
You must ensure that the “UncheckedTryToGetSpinlock()” API of the generated-OS is only called by category 1 ISRs. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 167 |
You must ensure that the “UncheckedReleaseSpinlock()” API of the generated-OS is only called by category 1 ISRs. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 170 |
You must ensure that the recommended compiler options are used for application code, as specified in the relevant RTA-OS Port Guide. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 171 |
You must ensure that the application is assembled with the recommended assembler version, as specified in the relevant RTA-OS Port Guide. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 172 |
You must ensure that the recommended assembler options are used for application code, as specified in the relevant RTA-OS Port Guide. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 173 |
You must ensure that the application linked with the generated-OS is using the recommended linker version, as specified in the relevant RTA-OS Port Guide. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 174 |
You must ensure that the recommended linker options are used for linking the application code with the generated-OS, as specified in the relevant RTA-OS Port Guide. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 175 |
You must check that the compilation options you have used for your own C code are compatible with those used by RTA-OS and listed in configuration summary report. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 177 |
You must ensure that sufficient stack space is allocated by the linker to handle the worst-case stack use. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 178 |
You must ensure that sufficient stack space is allocated for all of the stacks that the microcontroller supports. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 179 |
You must ensure that all the stacks required by the generated-OS are initialized with sufficient space for the needs of the safety-related system before starting the generated-OS. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 181 |
You must ensure that no APIs are called between calls to the “DisableAllInterrupts()” and “EnableAllInterrupts()” APIs. |
OS |
done |
RTA-CAR_V12.12.0_Safety_Manual |
accepted |
0.2 |
|
$ETAS_RTACAR_SM_OS 182 |
You must ensure that the only APIs that are called between calls to the “SuspendAllInterrupts()” and “ResumeAllInterrupts()” APIs are other calls to the suspend or resume interrupt APIs. |
OS |
done |
RTA-CAR_V12.12.0_Safety_Manual |
accepted |
0.2 |
|
$ETAS_RTACAR_SM_OS 183 |
You must ensure that the only APIs that are called between calls to the “SuspendOSInterrupts()” and “ResumeOSInterrupts()” APIs are calls to the suspend or resume interrupt APIs. |
OS |
done |
RTA-CAR_V12.12.0_Safety_Manual |
accepted |
0.2 |
|
$ETAS_RTACAR_SM_OS 184 |
You must ensure that calls to the “SuspendAllInterrupts()” and “ResumeAllInterrupts()” APIs are properly nested. |
OS |
done |
RTA-CAR_V12.12.0_Safety_Manual |
accepted |
1.0.0 |
|
$ETAS_RTACAR_SM_OS 185 |
You must ensure that calls to the “SuspendOSInterrupts()” and “ResumeOSInterrupts()” APIs are properly nested. |
OS |
done |
RTA-CAR_V12.12.0_Safety_Manual |
accepted |
1.0.0 |
|
$ETAS_RTACAR_SM_OS 186 |
You must ensure that category 1 ISRs, including those that handle CPU traps and exceptions as well as those that handle hardware interrupts, only call the following API functions: |
OS |
done |
RTA-CAR_V12.12.0_Safety_Manual |
accepted |
0.1 |
|
$ETAS_RTACAR_SM_OS 187 |
You must ensure that category 2 ISRs do not call the following API functions: |
OS |
done |
RTA-CAR_V12.12.0_Safety_Manual |
accepted |
0.1 |
|
$ETAS_RTACAR_SM_OS 188 |
You must ensure that all task entry functions are decorated with the “TASK()” macro. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 189 |
If the “Disallow Schedule()” optimization is enabled, you must ensure that no tasks use the “Schedule()” API call. |
OS |
done |
RTA-CAR_V12.12.0_Safety_Manual |
accepted |
1.1.0 |
|
$ETAS_RTACAR_SM_OS 190 |
If the “Disallow Upwards Activation” optimization is set to “TRUE” in the “RTA-OS” tab of the “OS Configuration->General->Optimizations” menu, you must ensure that no task directly activates a higher priority task in any way. |
OS |
done |
RTA-CAR_V12.12.0_Safety_Manual |
accepted |
1.1.0 |
|
$ETAS_RTACAR_SM_OS 191 |
If the “Fast Terminate” optimization is configured in the generated-OS, you must ensure that all the tasks in the application do only terminate inside their entry function. |
OS |
done |
RTA-CAR_V12.12.0_Safety_Manual |
accepted |
1.1.0 |
|
$ETAS_RTACAR_SM_OS 192 |
You must ensure that tasks must not call the following API functions: |
OS |
done |
RTA-CAR_V12.12.0_Safety_Manual |
accepted |
0.1 |
|
$ETAS_RTACAR_SM_OS 193 |
If the generated OS is monitoring the execution times of all tasks and category 2 ISRs using time monitoring, you must ensure that the appropriate callback functions are provided in the application source code. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 194 |
If the generated OS is monitoring the execution times of all tasks and category 2 ISRs using passive timing protection, you must ensure that the appropriate callback functions are provided in the application source code. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 195 |
If the generated OS is monitoring the execution times of all tasks and category 2 ISRs using active timing protection, you must ensure that the appropriate callback functions are provided in the application source code. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 196 |
If any register sets are configured in the “OS Configuration->Registers sets” menu, you must ensure that the appropriate callback functions are provided in the application source code for each register set. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 197 |
You must ensure that the idle mechanism that is declared via the “Os_Cbk_Idle()” callback function does not call the following API functions: |
OS |
done |
RTA-CAR_V12.12.0_Safety_Manual |
accepted |
0.1 |
|
$ETAS_RTACAR_SM_OS 206 |
You must ensure that the system-wide startup hook function and any defined OS-Application specific startup hook functions only use the following API calls: |
OS |
done |
RTA-CAR_V12.12.0_Safety_Manual |
accepted |
0.1 |
|
$ETAS_RTACAR_SM_OS 207 |
You must ensure that the system-wide shutdown hook function and any defined OS-Application specific shutdown hook functions only use the following API calls: |
OS |
done |
RTA-CAR_V12.12.0_Safety_Manual |
accepted |
0.1 |
|
$ETAS_RTACAR_SM_OS 208 |
You must ensure that any defined pre-task hook function only uses the following API calls: |
OS |
done |
RTA-CAR_V12.12.0_Safety_Manual |
accepted |
0.2 |
|
$ETAS_RTACAR_SM_OS 209 |
You must ensure that any defined post-task hook function only uses the following API calls: |
OS |
done |
RTA-CAR_V12.12.0_Safety_Manual |
accepted |
0.2 |
|
$ETAS_RTACAR_SM_OS 210 |
You must ensure, that any defined protection hook function only uses the following API calls: |
OS |
done |
RTA-CAR_V12.12.0_Safety_Manual |
accepted |
0.2 |
|
$ETAS_RTACAR_SM_OS 211 |
You must ensure that any defined stack overrun hook function only uses the following API calls: |
OS |
done |
RTA-CAR_V12.12.0_Safety_Manual |
accepted |
0.2 |
|
$ETAS_RTACAR_SM_OS 212 |
You must ensure that any defined time overrun hook function only uses the following API calls: |
OS |
done |
RTA-CAR_V12.12.0_Safety_Manual |
accepted |
0.2 |
|
$ETAS_RTACAR_SM_OS 213 |
You must ensure that the system-wide error hook function and any defined OS-Application specific error hook functions only use the following API calls: |
OS |
done |
RTA-CAR_V12.12.0_Safety_Manual |
accepted |
0.2 |
|
$ETAS_RTACAR_SM_OS 214 |
If alarms are configured to execute callback functions when they expire, you must ensure that the callback functions do not make any API calls other than those to suspend and resume all interrupts. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 215 |
You must ensure that all calls to the “SetAbsAlarm()” and “SetRelAlarm()” APIs do specify a cycle (3rd parameter) that is less than the “OSMAXALLOWEDVALUE” of their associated counter. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 216 |
You must ensure that all software counters are ticked at the correct rate, as defined in the configuration. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 217 |
You must ensure that every call to the following APIs to clear, get, set, or wait for a single event does use a named event that was declared in the configuration of RTA-OS: |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 218 |
You must ensure that every call to the following APIs must use a bitwise-or of named events that were declared in the configuration of RTA-OS: |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 219 |
You must ensure that every call to the “SetEvent()” API does have a corresponding call to the “ClearEvent()” API. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 220 |
If “Use RES_SCHEDULER” is set to “FALSE” in the “AUTOSAR” tab of the “OS Configuration->General->Optimizations” menu, you must ensure that the “RES_SCHEDULER” resource is never referenced in the application code. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 221 |
You must ensure that all resources locked by a task or category 2 ISR are unlocked before the task or ISR terminates. |
OS |
done |
RTA-CAR_V12.12.0_Safety_Manual |
accepted |
1.0.0 |
|
$ETAS_RTACAR_SM_OS 222 |
You must ensure that in every Critical Section that is defined by calls to the “GetResource()” and “ReleaseResource()” APIs none of the following APIs are called: |
OS |
done |
RTA-CAR_V12.12.0_Safety_Manual |
accepted |
0.2 |
|
$ETAS_RTACAR_SM_OS 223 |
If the application uses nested resource locking, you must ensure that the calls to the “GetResource()” and “ReleaseResource()” APIs are strictly nested. |
OS |
done |
RTA-CAR_V12.12.0_Safety_Manual |
accepted |
1.0.0 |
|
$ETAS_RTACAR_SM_OS 224 |
You must ensure that all schedule tables are ticked by the task or category 2 ISR that provides the tick source. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 225 |
You must ensure that all schedule tables are ticked by a counter at the correct rate, as defined in the configuration. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 227 |
You should have calculated how much stack space is required in the worst-case. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 229 |
You must ensure that an interrupt handler is provided for every enabled interrupt source to avoid unexpected interrupts being erroneously processed. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_OS 230 |
You must run a “Configuration Summary” report for the configuration and check that all entries reflect what you expect to be in the OS configuration. |
OS |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_RTE 003 |
You must not use the “--error-as-warning” RTEGen option. |
RTE |
done |
RTA-CAR_V12.12.0_Safety_Manual |
accepted |
0.1 |
|
$ETAS_RTACAR_SM_RTE 004 |
You must not use the “--disable-warning” RTEGen option. |
RTE |
done |
RTA-CAR_V12.12.0_Safety_Manual |
accepted |
0.1 |
|
$ETAS_RTACAR_SM_RTE 012 |
You must ensure that all hardware timers used to generate interrupts for task or runnable scheduling are programmed with the correct periodic rates. |
RTE |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_RTE 013 |
You must ensure that all OS tasks that need to use “RTE_RESOURCE” or “RTE_RESOURCE_COREx_OSAPP” for data consistency are configured with access to the appropriate resource object(s). |
RTE |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_RTE 017 |
If you use the “--deviate-split-swci-support” option, you must ensure the restrictions are followed. See RTA-RTE Reference Manual. |
RTE |
done |
RTA-CAR_V12.12.0_Safety_Manual |
accepted |
0.1 |
|
$ETAS_RTACAR_SM_RTE 021 |
You must check all transformer errors provided by extended RTE APIs and handle detected errors appropriately. |
RTE |
done |
RTA-CAR_V12.12.0_Safety_Manual |
rejected |
implement measures in RTE-GEN instead |
|
$ETAS_RTACAR_SM_RTE 023 |
You must ensure that SWCs with inter-ECU communication are located in the same partition as the corresponding COM module. |
RTE |
done |
RTA-CAR_V12.12.0_Safety_Manual |
rejected |
no meaningful automation possible |
|
$ETAS_RTACAR_SM_RTE 029 |
If Exclusive Areas are used, you must ensure that you have chosen the right data consistency mechanism. |
RTE |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_RTE 031 |
You must not override the schema that RTA-RTE uses to validate AUTOSAR XML description files. |
RTE |
done |
RTA-CAR_V12.12.0_Safety_Manual |
accepted |
0.1 |
|
$ETAS_RTACAR_SM_RTE 035 |
If the ECU instance for which the RTE is being generated relies on memory protection for synchronous client-server communication over “OSApplication” boundaries, you must enable the “Rte_Rips_CSSafety” plugin for each “PPortPrototype” which is connected to an “RPortPrototype” and where the client defining that “RPortProttype” is located in a different “EcucPartition” than the server. |
RTE |
new |
RTA-CAR_V12.12.0_Safety_Manual |
N/A |
||
$ETAS_RTACAR_SM_RTE 036 |
If you rely on memory protection, you must not use the option “-client-server-global-optimization”. |
RTE |
done |
RTA-CAR_V12.12.0_Safety_Manual |
accepted |
1.0.0 |