Safety Analysis

Addresses: ISO 26262-6 7.4.10, ISO 26262-8 12.4.2.1 j

This chapter holds the safety-oriented analysis of the runtime within the software architecture. 7.4.10 asks for it to be carried out in accordance with ISO 26262-9:2018, Clause 8, in order to:

provide evidence for the suitability of the software to provide the specified safety-related functions and properties as required by the respective ASIL;
identify or confirm the safety-related parts of the software; and
support the specification and verify the effectiveness of the safety measures.

Each potential error below is a way the runtime can deviate from what it should do. If we can detect it, a detection measure covers it and a test proves the detection works. If we can’t, it becomes a constraint on the integrator, because only they can rule it out. The errors of the tools are in the Tool Evaluation Report.

Potential Errors

Half of these are the rules of the rendering model turned upside down. Each one names the rule it violates, so the two stay in step.

Identifier	Description	Risk	Mitigation	Detectable
`slint.runtime.err.paint-order`	An element paints on top of one that should have covered it, against `sls.paint.order`.	A warning drawn behind its panel is invisible while the pixels are all otherwise correct.	`slint.runtime.avd.spec-tests`	Yes
`slint.runtime.err.blend-wrong`	Blending deviates from `sls.paint.blend.formula`.	Colors drift, so a red warning reads as a dull orange and no longer signals.	`slint.runtime.avd.spec-tests`	Yes
`slint.runtime.err.stale-pixels`	The frame buffer keeps content from the previous frame, against `sls.paint.window-opaque` or `sls.paint.blend.opaque`.	A warning that was cleared stays on the display.	`slint.compiler.avd.opaque-window`, `slint.runtime.avd.spec-tests`	Yes
`slint.runtime.err.buffer-overrun`	Painting runs past the end of the frame buffer, against `sls.paint.clip`.	Memory corruption in data that belongs to something else, not a wrong picture.	`slint.runtime.avd.buffer-size-check`, `slint.runtime.avd.spec-tests`	Yes
`slint.runtime.err.wrong-clip`	An element is clipped when it shouldn’t be, against `sls.paint.no-parent-clip`.	A truncated reading, so `120` displays as `12`.	`slint.runtime.avd.spec-tests`	Yes
`slint.runtime.err.stale-property`	A dependent value isn’t recomputed after the value it depends on changes.	The display shows a reading that was correct a moment ago and is wrong now.	`slint.runtime.avd.spec-tests`	Yes
`slint.runtime.err.eval-order`	Bindings evaluate in an order that shows a combination of values that never existed.	A single frame of a state the system was never in.	`slint.runtime.avd.spec-tests`	Yes
`slint.runtime.err.stack-overflow`	Recursion or deep nesting exhausts the stack. The runtime has no allocator, so storage failures are a stack concern rather than a heap one.	The application aborts, so the display freezes or goes blank.	`slint.compiler.cstr.no-unbounded-recursion`	Not decided yet
`slint.runtime.err.frame-overrun`	A frame takes longer to render than the display refresh interval.	The display freezes on old content, which is indistinguishable from a working one.	`slint.runtime.cstr.frame-time`	No
`slint.runtime.err.data-race`	The component is accessed from another thread while a render is in progress.	Any display error, including a partly drawn frame.	`slint.runtime.cstr.single-thread`	No
`slint.runtime.err.miscompiled`	The integrator’s Rust toolchain miscompiles the runtime or the generated code. The runtime ships as source, so the final binary isn’t built by us.	Any display error, and none of Slint SC’s evidence covers it.	`slint.runtime.cstr.qualified-toolchain`	No

Detection Measures and Usage Restrictions

A detection measure is something we do. A constraint is something we ask the integrator to do, and it exists only because no detection measure covers the error.

Identifier	Measure
`slint.runtime.avd.spec-tests`	Every paragraph of the rendering model and the generated code contract is traced to at least one test, and the runtime is held at complete structural coverage. See Test Coverage.
`slint.runtime.avd.buffer-size-check`	`render_rgb8` checks the frame buffer length and paints nothing if it doesn’t match, per `sls.gen.render-error`.
`slint.runtime.avd.no-allocator`	The runtime is `no_std`, doesn’t use `alloc`, and has no dependencies, so there’s no allocator to fail and no dynamic allocation to make timing unpredictable.

The errors no measure covers become runtime constraints.