3 ms·
industrial control != safety critical. "industrial control" covers both certified and non-certified code, you will have to be more specific than that for the p
by TickleSteve 10y ago
industrial control != safety critical.
"industrial control" covers both certified and non-certified code, you will have to be more specific than that for the purposes of this conversation.
Quite often, cases such as the pacemaker are flaws in system design, not code. (e.g. no secure messaging, probably due to the lack of awareness when it was designed).
That is not to say that safety-critical code is perfect... just that it has a lot more rigour and inspection involved than run-of-the-mill website code.
True, the expense and overhead does indeed affect the level of change that is acceptable to a business, but given that change is allowed, the quality of that change is what we're discussing here and all I'm saying is that there is a lot more rigour involved than most developers here are aware of.
- munificent 10y ago> That is not to say that safety-critical code is perfect... just that it has a lot more rigour and inspection involved than run-of-the-mill website code. I had assumed that as well until all of the horror stories around Toyota's firmware came to light. https://en.wikipedia.org/wiki/2009%E2%80%9311_Toyota_vehicle_recalls https://en.wikipedia.org/wiki/2009%E2%80%9311_Toyota_vehicle...
- TickleSteve 10y agoUnfortunately, we are human... Yes, the toyota case is a well publicised case. Consider though, the number of safety critical systems that are out there performing perfectly everyday. Of course, that is not proof of much, but the fact that you can name the Toyota case (and probably the Therac 25 case) means that the process generally works.