---
title: "Safety Analysis"
description: "What can go wrong in the slint-sc runtime, and what we do about each."
---
**Addresses:** ISO 26262-6 7.4.10, ISO 26262-8 12.4.2.1 j

This chapter holds the safety-oriented analysis of the runtime within the [software architecture](/qualification-plan/architecture/).
7.4.10 asks for it to be carried out in accordance with ISO 26262-9:2018, Clause 8, in order to:

* provide evidence for the suitability of the software to provide the specified safety-related functions and properties as required by the respective ASIL;
* identify or confirm the safety-related parts of the software; and
* support the specification and verify the effectiveness of the safety measures.

Each potential error below is a way the runtime can deviate from what it should do.
If we can detect it, a detection measure covers it and a test proves the detection works.
If we can't, it becomes a constraint on the integrator, because only they can rule it out.
The errors of the tools are in the [Tool Evaluation Report](/evaluation-report/potential-errors/).

## Potential Errors

Half of these are the rules of the [rendering model](/reference/rendering/) turned upside down.
Each one names the rule it violates, so the two stay in step.

| Identifier | Description | Risk | Mitigation | Detectable |
| --- | --- | --- | --- | --- |
| `slint.runtime.err.paint-order` | An element paints on top of one that should have covered it, against `sls.paint.order`. | A warning drawn behind its panel is invisible while the pixels are all otherwise correct. | [`slint.runtime.avd.spec-tests`](#slint.runtime.avd.spec-tests) | Yes |
| `slint.runtime.err.blend-wrong` | Blending deviates from `sls.paint.blend.formula`. | Colors drift, so a red warning reads as a dull orange and no longer signals. | [`slint.runtime.avd.spec-tests`](#slint.runtime.avd.spec-tests) | Yes |
| `slint.runtime.err.stale-pixels` | The frame buffer keeps content from the previous frame, against `sls.paint.window-opaque` or `sls.paint.blend.opaque`. | A warning that was cleared stays on the display. | [`slint.compiler.avd.opaque-window`](/evaluation-report/potential-errors/#slint.compiler.avd.opaque-window), [`slint.runtime.avd.spec-tests`](#slint.runtime.avd.spec-tests) | Yes |
| `slint.runtime.err.buffer-overrun` | Painting runs past the end of the frame buffer, against `sls.paint.clip`. | Memory corruption in data that belongs to something else, not a wrong picture. | [`slint.runtime.avd.buffer-size-check`](#slint.runtime.avd.buffer-size-check), [`slint.runtime.avd.spec-tests`](#slint.runtime.avd.spec-tests) | Yes |
| `slint.runtime.err.wrong-clip` | An element is clipped when it shouldn't be, against `sls.paint.no-parent-clip`. | A truncated reading, so `120` displays as `12`. | [`slint.runtime.avd.spec-tests`](#slint.runtime.avd.spec-tests) | Yes |
| `slint.runtime.err.stale-property` | A dependent value isn't recomputed after the value it depends on changes. | The display shows a reading that was correct a moment ago and is wrong now. | [`slint.runtime.avd.spec-tests`](#slint.runtime.avd.spec-tests) | Yes |
| `slint.runtime.err.eval-order` | Bindings evaluate in an order that shows a combination of values that never existed. | A single frame of a state the system was never in. | [`slint.runtime.avd.spec-tests`](#slint.runtime.avd.spec-tests) | Yes |

## Detection Measures and Usage Restrictions

A detection measure is something we do.
A constraint is something we ask the integrator to do, and it exists only because no detection measure covers the error.

| Identifier | Measure |
| --- | --- |
| <span id="slint.runtime.avd.spec-tests">`slint.runtime.avd.spec-tests`</span> | Every paragraph of the rendering model and the generated code contract is traced to at least one test, and the runtime is held at complete structural coverage. See [Test Coverage](/qualification-report/test-coverage/). |
| <span id="slint.runtime.avd.buffer-size-check">`slint.runtime.avd.buffer-size-check`</span> | `render_rgb8` checks the frame buffer length and paints nothing if it doesn't match, per `sls.gen.render-error`. |
| <span id="slint.runtime.avd.no-allocator">`slint.runtime.avd.no-allocator`</span> | The runtime is `no_std`, doesn't use `alloc`, and has no dependencies, so there's no allocator to fail and no dynamic allocation to make timing unpredictable. |