4 ms·

I've never written written safety critical software, but I believe the point is that "stop all execution" is not always an adequate response to an unknown stat

I've never written written safety critical software, but I believe the point is that "stop all execution" is not always an adequate response to an unknown state; this does not imply that "proceed as if nothing went wrong" is an acceptable response. I would imagine the response to an unknown state would be "return to a known state". This could be accomplished by rebooting (returning the software itself to a known good state), passing control to a redundant system (possibly done by halting all execution of the affected system, but the design needs to consider more than that), falling back to some form of a safe mode, where the bad state is not present, but safety critical functionality can continue.

WalterBright 8y ago
When you're at 30,000 feet, nobody wants to go experimenting with a system controlling critical flight operations that has gone into an unknown state. The pilot often has the option of rebooting the system and trying it again, but that's dangerous. On an episode of "Aviation Disasters", I don't remember the exact details, but the pilot got a warning of a failed system. After a consult with the ground, they told him to reboot it. After a while, it failed again. They told him don't worry about it, reboot it again. It (the airplane, that is) crashed. Aircraft systems are designed to be decoupled from each other as much as possible, so failures do not propagate. In particular, they must not propagate to the backup system, or the "safe mode". The engineers do work hard at this, and sometimes they don't get it right, and another bitter lesson is learned. The "safe mode" system must be physically and electrically decoupled from the normal system. An example of getting it wrong is I've seen demonstrations on TV of people hacking in through the wireless key locks on a car to take control of the brakes. That's seriously bad engineering - not so much the vulnerability to hacking because happens, but the fact that the door lock system is connected to the brake system. It's cowboy engineering at its worst.
- gizmo686 8y ago
  Keeping systems isolated is an orthogonal concern. The question is weather rebooting the system is safer then shutting it off. The fact that shutting it off should be safe is a separate concern. At a minimum, shutting it off reduces your redudancy; and it the system fails again (even in an undetected way), that should be fine, because you (should) have enough redundancy to handle an arbitrary system fail in unexpected ways.

WalterBright 8y ago

When you're at 30,000 feet, nobody wants to go experimenting with a system controlling critical flight operations that has gone into an unknown state. The pilot often has the option of rebooting the system and trying it again, but that's dangerous. On an episode of "Aviation Disasters", I don't remember the exact details, but the pilot got a warning of a failed system. After a consult with the ground, they told him to reboot it. After a while, it failed again. They told him don't worry about it, reboot it again. It (the airplane, that is) crashed. Aircraft systems are designed to be decoupled from each other as much as possible, so failures do not propagate. In particular, they must not propagate to the backup system, or the "safe mode". The engineers do work hard at this, and sometimes they don't get it right, and another bitter lesson is learned. The "safe mode" system must be physically and electrically decoupled from the normal system. An example of getting it wrong is I've seen demonstrations on TV of people hacking in through the wireless key locks on a car to take control of the brakes. That's seriously bad engineering - not so much the vulnerability to hacking because happens, but the fact that the door lock system is connected to the brake system. It's cowboy engineering at its worst.

gizmo686 8y ago
Keeping systems isolated is an orthogonal concern. The question is weather rebooting the system is safer then shutting it off. The fact that shutting it off should be safe is a separate concern. At a minimum, shutting it off reduces your redudancy; and it the system fails again (even in an undetected way), that should be fine, because you (should) have enough redundancy to handle an arbitrary system fail in unexpected ways.