Path: csiph.com!news.swapon.de!eternal-september.org!feeder.eternal-september.org!news.eternal-september.org!.POSTED!not-for-mail
From: Paul Rubin <no.email@nospam.invalid>
Newsgroups: comp.arch.embedded
Subject: Re: Safety-Critical Software Design
Date: Sat, 16 Jul 2016 23:10:13 -0700
Organization: A noiseless patient Spider
Lines: 34
Message-ID: <87twfodcca.fsf@jester.gateway.pace.com>
References: <87vb04oo9f.fsf@digitalsignallabs.com>
Mime-Version: 1.0
Content-Type: text/plain
Injection-Info: mx02.eternal-september.org; posting-host="52eac348160ce62b68e4635eee7cc854"; logging-data="5326"; mail-complaints-to="abuse@eternal-september.org";	posting-account="U2FsdGVkX1/P68sfe1FExw5ilBQEuDfk"
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/24.3 (gnu/linux)
Cancel-Lock: sha1:7TBTsU7kO8EDOpDPefeUmar58VY= sha1:un9k66DrzDwuUdslECKReZdJJL4=
Xref: csiph.com comp.arch.embedded:24630

Randy Yates <yates@digitalsignallabs.com> writes:
> Are there any formal requirements, guidelines, or recommendations for
> software which will run in a safety-critical environment in the United
> States or world-wide?

This is a reasonable place to start reading, and has some useful references:

   http://www.dwheeler.com/essays/high-assurance-floss.html

> My gut and experience tells me there should NEVER be software DIRECTLY
> controlling signals of devices that might lead to human injury. Rather,
> such devices should be controlled by discrete hardware, perhaps as
> complex as an FPGA.

Like an FPGA running a softcore microprocessor? ;-)

Yes there are microprocessors intended for safety-critical applications.
They have things like dual cpu's running in lockstep, predictable
realtime response, ECC memory all the way through, etc.  Some of the ARM
Cortex-R series are rated for this.  

  http://www.ti.com/ww/en/launchpad/launchpads-hercules.html

has some cheap experimentation kits.

There are some Haskell DSL's for generating realtime C code with
various error-prone issues handled for you automatically:

  https://github.com/Copilot-Language
  https://github.com/Copilot-Language/atom_for_copilot

I've played with Atom and ImPROVE a little bit but not the rest of Copilot.

You might also want to look at SPARK/Ada.