Path: csiph.com!usenet.blueworldhosting.com!feeder01.blueworldhosting.com!border2.nntp.dca1.giganews.com!nntp.giganews.com!buffer2.nntp.dca1.giganews.com!nntp.supernews.com!news.supernews.com.POSTED!not-for-mail
NNTP-Posting-Date: Sat, 16 Jul 2016 23:57:16 -0500
From: Randy Yates <yates@digitalsignallabs.com>
Newsgroups: comp.arch.embedded
Subject: Safety-Critical Software Design
Organization: Digital Signal Labs
Date: Sun, 17 Jul 2016 00:57:16 -0400
Message-ID: <87vb04oo9f.fsf@digitalsignallabs.com>
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/24.5 (gnu/linux)
Cancel-Lock: sha1:cBAHW8K946Mx1qnTNZdDTJUywrA=
MIME-Version: 1.0
Content-Type: text/plain
Lines: 32
X-Trace: sv3-bOpM4opgWhF73135WwHkcMhleWofFv1zVgc3ImEvX39+XMbT/49x+EiZlm28Lq4AJTdWMOdm4PEas/j!32Bsth1rjnTi4Hivt/PSgiM4LuYU6vcIFmRNDD9b7jF815q4Ir9uES5MQLRHv1ju9hkoJj+X
X-Complaints-To: www.supernews.com/docs/abuse.html
X-DMCA-Complaints-To: www.supernews.com/docs/dmca.html
X-Abuse-and-DMCA-Info: Please be sure to forward a copy of ALL headers
X-Abuse-and-DMCA-Info: Otherwise we will be unable to process your complaint properly
X-Postfilter: 1.3.40
X-Original-Bytes: 2414
Xref: csiph.com comp.arch.embedded:24629

Hi Everyone,

Are there any formal requirements, guidelines, or recommendations for
software which will run in a safety-critical environment in the United
States or world-wide?

By a "safety-critical" environment I mean an environment in which a
failure can lead to loss of, or serious injury to, human life. For
example, automobile navigation systems, medical devices, lasers, etc.

I know there is the MISRA association and MISRA C. I am wondering if
there are others. 

My gut and experience tells me there should NEVER be software DIRECTLY
controlling signals of devices that might lead to human injury. Rather,
such devices should be controlled by discrete hardware, perhaps as
complex as an FPGA. There is always going to be a chance that a real
processor that, e.g., controls the enable signal to a laser is going to
crash with the signal enabled.

I realize that hardware-only control is subject to failures as well,
but they wouldn't seem to be nearly as likely as a coding failure.

Let me get even more specific: would it be acceptable to use a processor
running linux in such an application? My gut reaction is "Not only no,
but HELL no," but I'm not sure if I'm being overly cautious.

Any guidance, suggestions, comments, etc., would be appreciated.
-- 
Randy Yates, DSP/Embedded Firmware Developer
Digital Signal Labs
http://www.digitalsignallabs.com