Tool Classification

Addresses: ISO 26262-8 11.4.5

This chapter classifies each tool whose failure could introduce an error into the product, or hide one.

Summary

The classes are Tool Impact (TI), Tool error Detection (TD), and the resulting Tool Confidence Level (TCL).

Tool	Ships	TI	TD	TCL	Qualified by
Slint compiler	No	TI2	TD2 or TD3	TCL2 or TCL3	Validation
slint-sc-coverage	No	TI2	Not decided yet	Not decided yet	Validation
Rust toolchain	No	Not classified yet
Test and coverage tooling	No	Not classified yet
slint-sc runtime	Yes	Not a tool			Component qualification

Slint Compiler

The slint-compiler translates .slint files into Rust code that is compiled into the final executable.

• Tool Impact (TI2): The slint-compiler can introduce errors into the executable.
• Tool Error Detection (TD2/TD3): While Rust’s strong type system and borrow checker catch many errors, compiler bugs might still bypass detection.
• Tool Confidence Level (TCL): The combination of TI2 and TD2/TD3 results in a Tool Confidence Level of TCL2 or TCL3.
• Qualification Strategy: The slint-compiler is not yet qualified and must be qualified before being used in a safety-critical project.

TODO

Settle TD, and with it the TCL. TD2 and TD3 lead to different qualification methods under ISO 26262-8 11.4.6, so this can’t stay a range. The detection measures that back the choice belong here too, once the potential errors are written up.

slint-sc-coverage

slint-sc-coverage reports which parts of the .slint code the tests reached, from the map the Slint SC compiler writes and LLVM’s coverage of the generated code, see Coverage of Slint Code. It doesn’t ship, and its output is evidence: a report of coverage that wasn’t achieved hides untested code.

• Tool Impact (TI2): the tool can fail to detect an error, by reporting a point as reached that wasn’t, or by leaving a point out.
• Tool Error Detection: runtime test cases state their expected coverage in the source and fail on any difference, on every run; see Coverage Tool Verification.
• Qualification Strategy: the tool is classified with the compiler, under ISO 26262-8 11.4.5 as above.

TODO

Settle TD, and with it the TCL, from the detection measures above, alongside the compiler’s.

Rust Toolchain

The toolchain of each evidence run is recorded in the Test Results chapter.

TODO

Qualification evidence runs should use a qualified toolchain, such as a Ferrocene release, whose own classification is in its qualification material. That policy isn’t decided or enforced yet; development builds use stable Rust.

Test and Coverage Tooling

The suites are run by cargo test and cargo llvm-cov, and the evidence chapters are produced by slint-doc-generator.

TODO

Classify these. Every detection measure in this report rests on them, so their tool impact and error detection have to be argued like any other tool. A harness that reports a passing suite that didn’t pass, or coverage that wasn’t achieved, would hide exactly the errors those measures claim to catch.

slint-sc Runtime

The runtime is not a tool. It ships inside the customer’s binary, so it is qualified as a software component under ISO 26262-8 Clause 12 and carries no tool confidence level. See the Component Qualification Plan.