diff --git a/process/process_areas/problem_resolution/guidance/problem_resolution_checklist.rst b/process/process_areas/problem_resolution/guidance/problem_resolution_checklist.rst index 5788ca3c80e..38a4c5b34c2 100644 --- a/process/process_areas/problem_resolution/guidance/problem_resolution_checklist.rst +++ b/process/process_areas/problem_resolution/guidance/problem_resolution_checklist.rst @@ -20,7 +20,7 @@ Problem Checklist .. gd_chklst:: Problem Review Checklist :id: gd_chklst__problem_cr_review :status: valid - :version: 1 + :version: 2 :tags: problem_resolution :complies: @@ -73,7 +73,7 @@ Problem Checklist - * - 9 - - Does the Problem report have a category as specified? + - Is the category provided, with safety or security relevance confirmed or disconfirmed by the respective manager where applicable? - * - 10 @@ -81,20 +81,32 @@ Problem Checklist - * - 11 - - Does the Problem report have the affected release versions as specified? + - Are the detection version and affected versions, including versions derived from the faulty version, documented? - * - 12 - - Does the Problem report have an expected closure date as specified? + - Does the Problem report have an expected closure version or milestone as specified? - * - 13 - - Does the Problem report have the solution measures specified, verified and reported? + - Where measures are implemented, are they specified with implementation and effectiveness-verification evidence? - * - 14 - If the Problem report is not closed and pending solution measures are open, escalated to the :need:`rl__safety_manager` or :need:`rl__security_manager`? - + * - 15 + - Is the need for notification explained, and is any notification recorded? + - + + * - 16 + - Where safety is affected, does a rationale support either an implemented adequate safety measure with verified effectiveness, or an evaluation that the problem does not constitute an unreasonable risk? + - + + * - 17 + - Where safety is affected, is the closure rationale documented and reviewed, with the review result recorded? + - + .. needextend:: "c.this_doc()" :+tags: problem_resolution diff --git a/process/process_areas/problem_resolution/guidance/problem_resolution_guideline.rst b/process/process_areas/problem_resolution/guidance/problem_resolution_guideline.rst index 694e3498552..c05573ef9ca 100644 --- a/process/process_areas/problem_resolution/guidance/problem_resolution_guideline.rst +++ b/process/process_areas/problem_resolution/guidance/problem_resolution_guideline.rst @@ -18,7 +18,7 @@ Guideline .. gd_guidl:: Problem Resolution Guideline :id: gd_guidl__problem_problem :status: valid - :version: 1 + :version: 2 :complies: std_req__iso26262__management_5431[version==1], std_req__iso26262__management_5433[version==1], std_req__iso26262__management_5434[version==1], @@ -130,9 +130,10 @@ Tracking System. The title of the Problem Report should reflect the topic accordingly. -The description should reflect the problem root cause and impact in detail. +The description should reflect the problem root cause, if known, and its impact, including +known side effects on other functionality or dependent components. -If applicable affected parties should be notified. +Assess notification needs according to :ref:`prm_notifications`. Further supporting information should ge given, especially how to reproduce the problem, and what is the error occurrence rate? @@ -142,9 +143,10 @@ If safety is affected, the ASIL classification should be added, if applicable. The problem should be classified according minor, major, critical or blocker. -The affected versions of the release should be documented. After detection of the -problem, checking the affected versions is critical to understand the impact of the -problem. Thus document the first affected version and the last affected version. +Document the version where the problem was detected and the first and last affected +versions, including versions derived from the faulty version. Where applicable, identify +affected branches and dependent integrations. Record unknown affected versions as +"under investigation" and update them during analysis. .. note:: | For the Problem Report Example: @@ -167,6 +169,23 @@ When ready to review and to analyze, the author sets the status to "in review" m | * The "Process Development Community" dashboard is added and the status must be changed to **Todo** | * The combination of the issue**Open** and **Todo** defines the status **in review** +.. _prm_notifications: + +Notification of Affected Parties +-------------------------------- + +Notification is needed when the problem's impact requires affected parties to assess +their use of the software or take action, such as applying a workaround or an update. +Consider affected users, integrators and feature or component maintainers, and the +Safety or Security Manager where applicable. + +The :need:`Project Lead ` communicates the problem status to affected +parties. Record whether notification is needed and why in the Problem Report's notification +section. If needed, notify the affected parties through an issue comment with an explicit +mention or another appropriate channel. Record who was notified, when and how, using a +comment link or communication reference. +For suspected vulnerabilities, follow the project's confidential reporting policy. + .. _prm_analyze_problem_report: Analyze Problem Report @@ -188,25 +207,36 @@ If applicable, the features affected should be identified too. The description shall reflect the result of the analysis. -Topics to checked (critical topics are marked with x): - -- [x] Is the problem description clear and detailed enough to understand the problem and its impact? -- [x] Is the problem root cause clearly described? -- [x] Is the problem impact clearly described? -- [ ] Is notification of affected parties required? If yes, are the affected parties notified? -- [ ] Are there any proposed solutions provided? -- [ ] Are there any further linked issues or pull requests provided? -- [x] Is the error occurrence rate provided? If yes, is it high enough to accept the problem? -- [x] Is the problem reproducible? -- [ ] Are there any further supporting information provided? -- [x] Is the problem classification correct? -- [x] Is information for the affected version of the release provided? If yes, is it correct? -- [ ] Is the information for the expected closure version provided? If yes, is it correct? -- [x] Is the problem affecting safety or security? If yes, is the classification correct? - -The analysis phase can not be closed, until all critical topics are -clarified and provided in the description. If not, the problem report should be rejected -and closed with the reason "Closed as not planned". +Where safety or security may be affected, the responsible +:need:`Safety Manager ` or :need:`Security Manager `, +respectively, confirms or disconfirms the relevance and records the reason. + +A review **topic** is a question used to check the information and decisions in a Problem +Report. A **critical review topic** must be addressed before approving the analysis. +This is independent of the problem severity classification **critical**. +The following topics shall be checked: + +* **Critical:** Is the problem description clear, including its impact? +* **Critical:** Is the root cause described, or identified as under investigation? +* **Critical:** Are the occurrence rate and reproduction information provided, as far as known? +* **Critical:** Is the problem classification correct? +* **Critical:** Are the affected versions identified, including versions derived from the faulty version? +* **Critical:** Is the safety or security relevance assessed, where applicable? +* Is notification needed, and have affected parties been notified? +* Are proposed solutions, supporting information and related issues or pull requests provided? +* Are the responsible stakeholders and expected closure version identified? + +.. _prm_problem_disposition: + +Disposition of Review Topics +^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +If a critical topic is not clarified, keep the report "in review" or return it to "open" +for further information according to :need:`wf__problem_analyze_pr`. Record the open +question and the analysis result. Missing information alone is not a reason for rejection. +If the problem is rejected, document the reason. Rejection or cancellation does not mean +that a problem where safety is affected is managed to closure; see +:ref:`prm_safety_affected_closure`. .. note:: | For the Problem Report Example: @@ -291,18 +321,40 @@ the problem, until they are closed. :need:`[[title]] ` checks finally if the problem Resolution is sufficient before the status is finally closed. To check, if it is sufficient, :need:`Problem Checklist ` may used. -Further the effectiveness of the implemented measure is confirmed and the availability -of the required reports, as verification results, if applicable. +Where measures are implemented, confirm their effectiveness and record the verification +results. Consider and document side effects of the implemented measure, such as reduced +performance, and include them in the verification as applicable. +For problems where safety is affected, apply :ref:`prm_safety_affected_closure`. -When confirmed, the author sets the status to "closed" manually, if not done automatically. +Closure follows :need:`wf__problem_close_pr` and :need:`gd_req__problem_check_closing`. .. note:: | For the Problem Report Example 2: | * The status of the issue is provided by the Issue Tracking System as: **Closed** | * The combination of **Closed** and any "Process Development Community" status **Done** and the Pull Request status **Merged** defines the status **closed** -:need:`[[title]] ` has the freedom to reject it at any time by setting the status -to "reject". +If the resolution is insufficient, keep the status "in implementation". + +.. _prm_safety_affected_closure: + +Closure of Problems Where Safety Is Affected +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +For a Problem Report classified as **Safety affected**, closure shall be supported by +one of the following: + +* An adequate safety measure has been implemented to resolve the problem, based on a + rationale, and its effectiveness has been verified. +* An evaluation concludes that the problem does not constitute an unreasonable risk, + supported by a rationale. + +For either condition, document the rationale and its review result in the Problem Report. +Include effectiveness-verification results for an implemented measure, or the risk +evaluation for the second condition. A software fix or fixed version is not required +for the second condition. + +Without a documented and reviewed rationale, the problem is not managed to closure. +These conditions do not change the responsibilities defined in :need:`wf__problem_close_pr`. .. needextend:: "c.this_doc()" :+tags: problem_resolution diff --git a/process/process_areas/problem_resolution/guidance/problem_resolution_reqs.rst b/process/process_areas/problem_resolution/guidance/problem_resolution_reqs.rst index 533aa98f98b..5710db7427a 100644 --- a/process/process_areas/problem_resolution/guidance/problem_resolution_reqs.rst +++ b/process/process_areas/problem_resolution/guidance/problem_resolution_reqs.rst @@ -70,7 +70,7 @@ Problem Attributes .. gd_req:: Problem attribute: description :id: gd_req__problem_attr_impact_description :status: valid - :version: 1 + :version: 2 :tags: manual_prio_1, problem_resolution, attribute, mandatory :satisfies: wf__problem_create_pr[version==1], wf__problem_analyze_pr[version==1], @@ -80,10 +80,26 @@ Problem Attributes Exact description of the Problem, including potential cause and impact of the problem. - Record especially, if functional safety or cybersecurity may affected here. + Record especially whether functional safety or cybersecurity may be affected. + + Record affected parties, whether notification is needed and why, and who was notified + and when. See :ref:`prm_notifications`. + +.. gd_req:: Problem attribute: affected versions + :id: gd_req__problem_attr_affected_versions + :status: valid + :version: 1 + :tags: manual_prio_1, problem_resolution, attribute, mandatory + :satisfies: wf__problem_create_pr[version==1], + wf__problem_analyze_pr[version==1], + wf__problem_initiate_monitor_pr[version==1], + wf__problem_close_pr[version==1] + :complies: std_req__aspice_40__SUP-9-BP2[version==1] - Record potential affected parties, and if it may required to notify them about the potential - problem. + Each Problem shall record the detection version and the first and last affected versions, + including versions derived from the faulty version. Identify affected branches and + dependent integrations where applicable. Record unknowns as under investigation and + update them during analysis. .. gd_req:: Problem attribute: analysis results :id: gd_req__problem_attr_analysis_results @@ -133,7 +149,7 @@ Problem Attributes .. gd_req:: Problem attribute:: safety affected :id: gd_req__problem_attr_safety_affected :status: valid - :version: 1 + :version: 2 :tags: prio_1_automation, problem_resolution, attribute, mandatory :satisfies: wf__problem_create_pr[version==1], wf__problem_analyze_pr[version==1], @@ -146,12 +162,15 @@ Problem Attributes * Yes * No - Note: If neither security or safety relevance is set the bug is always quality relevant. + Where safety may be affected, the responsible :need:`Safety Manager ` + shall confirm or disconfirm safety relevance and record the reason. + + Note: If neither safety nor security is affected, the problem is quality relevant. .. gd_req:: Problem attribute:: security affected :id: gd_req__problem_attr_security_affected :status: valid - :version: 1 + :version: 2 :tags: prio_1_automation, problem_resolution, attribute, mandatory :satisfies: wf__problem_create_pr[version==1], wf__problem_analyze_pr[version==1], @@ -164,7 +183,10 @@ Problem Attributes * Yes * No - Note: If neither security or safety relevance is set the bug is always quality relevant. + Where security may be affected, the responsible :need:`Security Manager ` + shall confirm or disconfirm security relevance and record the reason. + + Note: If neither safety nor security is affected, the problem is quality relevant. .. gd_req:: Problem attribute: milestone :id: gd_req__problem_attr_milestone @@ -219,5 +241,29 @@ Problem Resolution Checks ISSUEs related to Problem Reports shall not automatically closed, if linked ISSUEs or PRs are closed or merged and these ISSUEs shall be closed only manually from the :need:`Committer `. +.. gd_req:: Closure conditions for problems where safety is affected + :id: gd_req__problem_check_safety_closure + :status: valid + :version: 1 + :tags: manual_prio_1, problem_resolution, check + :satisfies: wf__problem_close_pr[version==1] + :complies: std_req__iso26262__management_5433[version==1] + + A problem classified as Safety affected shall be considered managed to closure only + when a rationale supports either an implemented adequate safety measure whose + effectiveness has been verified, or an evaluation that the problem does not constitute + an unreasonable risk. + +.. gd_req:: Documentation and review of closure rationale where safety is affected + :id: gd_req__problem_check_safety_rationale + :status: valid + :version: 1 + :tags: manual_prio_1, problem_resolution, check + :satisfies: wf__problem_close_pr[version==1] + :complies: std_req__iso26262__management_5434[version==1] + + For either safety-specific closure condition, the rationale shall be documented and + reviewed. Record the review result. See :ref:`prm_safety_affected_closure`. + .. needextend:: "c.this_doc()" :+tags: problem_resolution diff --git a/process/process_areas/problem_resolution/guidance/problem_resolution_template.rst b/process/process_areas/problem_resolution/guidance/problem_resolution_template.rst index 6b433299ea8..ebb7c1d8eee 100644 --- a/process/process_areas/problem_resolution/guidance/problem_resolution_template.rst +++ b/process/process_areas/problem_resolution/guidance/problem_resolution_template.rst @@ -20,7 +20,7 @@ Problem Report Template .. gd_temp:: Problem Template :id: gd_temp__problem_template :status: valid - :version: 1 + :version: 2 :complies: std_req__aspice_40__SUP-9-BP1[version==1], std_req__aspice_40__SUP-9-BP2[version==1], std_req__aspice_40__SUP-9-BP3[version==1], @@ -51,13 +51,24 @@ Problem description ------------------- [What is the problem?] -| Determine the cause of the problem, if possible. -| Determine the impact of the problem, if possible. -| Is notification required due to determined impact on affected parties? +| Describe the observed deviation and its known or potential impact. +| Document the cause, if known; otherwise record that it is under investigation. | (to be filled out during :need:`wf__problem_create_pr`) | (to be updated during :need:`wf__problem_analyze_pr`) +Problem notifications +--------------------- +[Is notification needed, and who was notified?] + +Record whether notification is needed and why. If needed, record who was notified, +when and how, for example a link to an issue comment with an explicit mention or an +email reference. Listing a recipient alone does not record a performed notification. +See :ref:`prm_notifications`. + +| (to be filled out during :need:`wf__problem_create_pr`, as far as known) +| (to be updated during :need:`wf__problem_analyze_pr`) + Problem supporting information ------------------------------ [How to reproduce the problem?] @@ -79,8 +90,8 @@ Problem category Safety, Security: Additional qualifiers to highlight, if safety or security is affected -They qualifiers have to be filled. If not filled out, a quality problem is assumed as -default category. +Record whether safety or security is affected. If uncertain, state this for analysis. +If neither is affected, the problem is quality relevant. In addition to the category Safety affected, the ASIL classification may be added in the documentation, if applicable. @@ -127,24 +138,27 @@ Determine if Urgent resolution is required? (yes, no, only valid for critical, b | (to be filled out during :need:`wf__problem_create_pr`) | (to be updated during :need:`wf__problem_analyze_pr`) -Problem affected version ------------------------- -[What version of the release is affected?] +Problem affected versions +------------------------- +[Where was the problem detected, and which versions are affected?] -Document the version of the release where the problem was detected. +Document the detection version and the first and last affected versions, including versions +derived from the faulty version. Add affected branches or dependent integrations where +applicable. Record unknowns as "under investigation" and update them during analysis. -| (to be filled out during :need:`wf__problem_create_pr`) +| (to be filled out during :need:`wf__problem_create_pr`, as far as known) +| (to be updated during :need:`wf__problem_analyze_pr`) Problem analysis results ------------------------ [What is the problem analysis result? Accepted or Rejected?] -| Especially document rejection reason, if applicable +Record the analysis result and the reason for rejection, if applicable. -In addition the safety/security relevance is confirmed or disconfirmed by safety/Security -Experts. - -| Especially document disconfirming reason, if applicable +The responsible :need:`Safety Manager ` confirms or disconfirms safety +relevance where safety may be affected; the responsible +:need:`Security Manager ` does so where security may be affected. +Record the reason, especially when disconfirming relevance. (to be filled out during :need:`wf__problem_analyze_pr`) @@ -181,6 +195,20 @@ Are all arguments convincing | (to be filled out during :need:`wf__problem_initiate_monitor_pr`) | (to be updated during :need:`wf__problem_close_pr`) +Problem closure where safety is affected +---------------------------------------- +[Which safety-specific closure condition is met, and what supports it?] + +Select and justify one condition according to :ref:`prm_safety_affected_closure`: + +* An adequate safety measure is implemented and its effectiveness is verified. +* A risk evaluation concludes that the problem does not constitute an unreasonable risk. + +Document the rationale, supporting verification results or risk evaluation, and the +rationale review result. + +(to be filled out during :need:`wf__problem_close_pr`) + Problem escalations ------------------- [Document escalation activities, if applicable] diff --git a/process/process_areas/problem_resolution/problem_resolution_concept.rst b/process/process_areas/problem_resolution/problem_resolution_concept.rst index c4c0fa1b62a..fa2d3ea0c09 100644 --- a/process/process_areas/problem_resolution/problem_resolution_concept.rst +++ b/process/process_areas/problem_resolution/problem_resolution_concept.rst @@ -30,7 +30,7 @@ Key concept A Problem Report is the **ONLY** way to report deviations of an expected result for existing features in the project. Deviations include problems found by user, bugs found during verification activities by tester, quality issues found by quality -checks, safety anomalies, vulnerabilities or any other malfunction. +checks, problems where safety is affected, vulnerabilities or any other malfunction. Inputs ****** @@ -138,5 +138,7 @@ Problem Report to be closed. Especially the effectiveness of the solution measures must be shown, based on convincing arguments, e.g. verification measures must be used to confirm the implementation. +For problems where safety is affected, see :ref:`prm_safety_affected_closure`. + .. needextend:: "c.this_doc()" :+tags: problem_resolution diff --git a/process/process_areas/problem_resolution/problem_resolution_workflow.rst b/process/process_areas/problem_resolution/problem_resolution_workflow.rst index 15a3032d925..49e50451a5a 100644 --- a/process/process_areas/problem_resolution/problem_resolution_workflow.rst +++ b/process/process_areas/problem_resolution/problem_resolution_workflow.rst @@ -31,7 +31,7 @@ For a detailed explanation of workflows and their role within the process model, rl__quality_manager[version==1] :input: wp__issue_track_system[version==1], wp__prm_plan[version==1] :output: wp__issue_track_system[version==1] - :contains: gd_temp__problem_template[version==1], gd_chklst__problem_cr_review[version==1], gd_guidl__problem_problem[version==1] + :contains: gd_temp__problem_template[version==2], gd_chklst__problem_cr_review[version==2], gd_guidl__problem_problem[version==2] :has: doc_concept__problem_process[version==1], doc_getstrt__problem_process[version==1] The Problem Report is created. @@ -52,7 +52,7 @@ For a detailed explanation of workflows and their role within the process model, rl__quality_manager[version==1] :input: wp__issue_track_system[version==1], wp__prm_plan[version==1] :output: wp__issue_track_system[version==1] - :contains: gd_temp__problem_template[version==1], gd_chklst__problem_cr_review[version==1], gd_guidl__problem_problem[version==1] + :contains: gd_temp__problem_template[version==2], gd_chklst__problem_cr_review[version==2], gd_guidl__problem_problem[version==2] :has: doc_concept__problem_process[version==1], doc_getstrt__problem_process[version==1] The Problem Report is analyzed. @@ -77,7 +77,7 @@ For a detailed explanation of workflows and their role within the process model, rl__quality_manager[version==1] :input: wp__issue_track_system[version==1], wp__prm_plan[version==1] :output: wp__issue_track_system[version==1] - :contains: gd_temp__problem_template[version==1], gd_chklst__problem_cr_review[version==1], gd_guidl__problem_problem[version==1] + :contains: gd_temp__problem_template[version==2], gd_chklst__problem_cr_review[version==2], gd_guidl__problem_problem[version==2] :has: doc_concept__problem_process[version==1], doc_getstrt__problem_process[version==1] The Problem Resolution is implemented and monitored. @@ -102,7 +102,7 @@ For a detailed explanation of workflows and their role within the process model, :supported_by: rl__safety_manager[version==1], rl__security_manager[version==1], rl__quality_manager[version==1] :input: wp__issue_track_system[version==1], wp__prm_plan[version==1] :output: wp__issue_track_system[version==1] - :contains: gd_temp__problem_template[version==1], gd_chklst__problem_cr_review[version==1], gd_guidl__problem_problem[version==1] + :contains: gd_temp__problem_template[version==2], gd_chklst__problem_cr_review[version==2], gd_guidl__problem_problem[version==2] :has: doc_concept__problem_process[version==1], doc_getstrt__problem_process[version==1] The Problem Resolution is closed.