Top-Level Requirements
The seven top-level requirements state what the Safe Data API guarantees at
the level of the safety function. Each is refined by detailed requirements
(SD-REQ-…, see Detailed Requirements) that state how the guarantee is
delivered and that are individually verified by test cases.
All data protected by the Safe Data API shall be sealed with an integrity tag, and integrity shall be checked before protected data is handed to the application, so that corruption of the payload, the redundant copy, or the stored tag is detected before corrupt data can be consumed. |
Every modification of protected data shall be atomic with respect to concurrent access and shall leave the container in a sealed, verifiable state. A torn, half-applied, or stale-tagged modification shall not be observable by any reader. |
When redundant storage is configured, the API shall recover protected data from any single-copy fault, and shall report — never mask or “repair” by fabrication — faults that exceed the recovery capability. |
Every integrity-relevant event shall be observable by the application or a health monitor, and the control-flow reaction to unrecoverable faults shall be configurable to match the integrating system’s safety concept. |
API operations shall provide bounded blocking behaviour when configured, and misuse from an illegal execution context shall be caught instead of producing undefined kernel behaviour. |
The API shall reject invalid use at the earliest possible binding time — at compile time where expressible, otherwise at run time with a defined error code — and shall allow reducing the API surface for certified builds. |
The integrity mechanism itself shall be diagnosable: a self-test shall detect a defective tag computation as well as broken detection and recovery logic. |
Refinement overview
ID |
Title |
Refines Back |
|---|---|---|
Integrity detection by construction |
||
Consistent modification |
||
Single-fault recovery |
||
Fault reaction and observability |
||
Timing and execution-context safety |
||
Defensive interface |
||
Self-diagnosis of the integrity mechanism |