5 ms·

(Disclaimer: SIL-4 programmer for safety critical rail transportation applications) The way this is done is that 2 of 3 computers need to 'agree' on the final

(Disclaimer: SIL-4 programmer for safety critical rail transportation applications) The way this is done is that 2 of 3 computers need to 'agree' on the final decision in order for it to be considered the correct one - there isn't a single point of assessment, but rather a consensus that must be formed from the results of all 3 computers. Ideal case, all 3 produce the same results. This has worked successfully for decades. What's changing now, is that those 3 computers are now no longer the same architecture - you'll have a PPC and an x86 and an ARM-based CPU all attempting to agree to the same data, in order to prevent systemic failure throughout.

WWLink 7y ago
What would be cool is if the software and hardware design is done by 3 completely different teams. Hehe.
- crocal 7y ago
  Tried already! It’s a disaster. Nancy Leveson & friends wrote articles about this. Yet, there are still people today convinced diverse programming is a good idea... Sigh. https://dblp.org/rec/conf/icse/JaffeL01 https://dblp.org/rec/conf/icse/JaffeL01
  - jimktrains2 7y ago
    Do you have a link to a readable copy?
    - crocal 7y ago
      Whoops. Wrong article. Apologies. Blame my big fingers on this phone. The article is: « Analysis of Faults in an N-Version Software Experiment." Susan S. Brilliant, John C. Knight, Nancy G. Leveson (1990) And I found a PDF version here: http://sunnyday.mit.edu/papers/nver2.pdf http://sunnyday.mit.edu/papers/nver2.pdf
  - yborg 7y ago
    >1990 study >student programmers >toy problem To me, this proves very little about how independent development teams would perform with experienced engineers working with present day design tools. It's possible that the results would be the same, worse, or better, but I hope this isn't the most recent research that's been done on this. The main issue with this approach is of course - cost. So the question is whether having two systems with uncorrelated fault paths is worth doubling the development expense.
crocal 7y ago
(Same disclaimer) > What's changing now, is that those 3 computers are now no longer the same architecture I think / hope this idea will die a well deserved death. Rail systems must face 25 years lifetime and with such design obsolescence headaches are multiplied by 3. In addition this creates bugs and integration nightmares. And on top of all that, we have known for decades that CPUs can be protected against systemic failures using the vital coded processor technique [1]. Note to the curious: this is one of the most fascinating piece of software I have ever encountered. Make the software resilient to any hardware fault through the power of arithmetic... [1] https://www.semanticscholar.org/paper/Vital-software%3A-Formal-method-and-coded-processor-Dollé/3a4a1645e672353c49d2c41718fe010c5fa2405b https://www.semanticscholar.org/paper/Vital-software%3A-Form...
- deleted 7y ago
  [deleted]
- fit2rule 7y ago
  SIL-4 doesn't generally follow the same rules as consumer computing, as I'm sure you are aware. There are track-side systems still running on 80386's, and a maintenance infrastructure in place to keep these systems running for at least a few more years, before they are replaced with the newer, Pentium-based systems. Design obsolescence is not built-in for these systems. Long-term ability to support is more important. Also, burn-in period. Many bullets (SPECTRE, etc.) have been dodged by relying on older, more proven, more tested technologies ..
  - crocal 7y ago
    Design obsolescence is absolutely built-in for railway systems (safety related or not). It’s part of the fun of the profession to deal with bizarre voltages that are inherited from the 1930s. For sure it’s not something consumer electronics care for but that’s precisely the point I am making. Actually, it’s one of the required extension to ISO 9002 by IRIS, the quality framework for rail engineers. Components are chosen not only for their function but also for their supply availability in the long run. One of the things we look at is « multisourcing »: how many different folks can provide this stuff. The more the better. Going back to this great idea about hardware diversity (that is absolutely not a general rule in railway): with an architecture requiring 3 different hardwares, you essentially shoot yourself in the foot. Instead of having 3 suppliers for one component, now you need to find at least 6 for 3 components. And the probability to face an obsolescence issue has basically tripled... And for what? It’s proven useless by science... :b And as far as dodging bullets, railway is no better than SCADA. Older tech means older vulnerabilities stay in place, and there are countless people on HN that will tell you it’s /not/ a good thing. I don’t think we dodged, I think we were just lucky. There is a reason why now cybersecurity is making its way inside the last revision of standards.
noir_lord 7y ago
Out of curiously, would you recommend any good journals, magazines or books for people in your industry (grokkable by a general level programmer ideally but not that bothered if not). I find all the different domains of programming endlessly facinating.
- fit2rule 7y ago
  Alas, its a very academic and dry field in terms of interesting literature, but you can definitely learn a lot from a few books .. Safety Critical Systems Handbook: https://www.elsevier.com/books/the-safety-critical-systems-handbook/smith/978-0-12-805121-4 https://www.elsevier.com/books/the-safety-critical-systems-h... IEC 61508 Compliance Guide: https://www.perforce.com/resources/qac/how-comply-iec-61508-standard https://www.perforce.com/resources/qac/how-comply-iec-61508-... ISA Safety Series: https://www.isa.org/standards-and-publications/isa-publications/isa-books/find-books/compilations/safety-book-series/ https://www.isa.org/standards-and-publications/isa-publicati...
  - noir_lord 7y ago
    These look interesting, Thank you!

WWLink 7y ago

What would be cool is if the software and hardware design is done by 3 completely different teams. Hehe.

crocal 7y ago
Tried already! It’s a disaster. Nancy Leveson & friends wrote articles about this. Yet, there are still people today convinced diverse programming is a good idea... Sigh. https://dblp.org/rec/conf/icse/JaffeL01 https://dblp.org/rec/conf/icse/JaffeL01
- jimktrains2 7y ago
  Do you have a link to a readable copy?
  - crocal 7y ago
    Whoops. Wrong article. Apologies. Blame my big fingers on this phone. The article is: « Analysis of Faults in an N-Version Software Experiment." Susan S. Brilliant, John C. Knight, Nancy G. Leveson (1990) And I found a PDF version here: http://sunnyday.mit.edu/papers/nver2.pdf http://sunnyday.mit.edu/papers/nver2.pdf
- yborg 7y ago
  >1990 study >student programmers >toy problem To me, this proves very little about how independent development teams would perform with experienced engineers working with present day design tools. It's possible that the results would be the same, worse, or better, but I hope this isn't the most recent research that's been done on this. The main issue with this approach is of course - cost. So the question is whether having two systems with uncorrelated fault paths is worth doubling the development expense.

crocal 7y ago

(Same disclaimer) > What's changing now, is that those 3 computers are now no longer the same architecture I think / hope this idea will die a well deserved death. Rail systems must face 25 years lifetime and with such design obsolescence headaches are multiplied by 3. In addition this creates bugs and integration nightmares. And on top of all that, we have known for decades that CPUs can be protected against systemic failures using the vital coded processor technique [1]. Note to the curious: this is one of the most fascinating piece of software I have ever encountered. Make the software resilient to any hardware fault through the power of arithmetic... [1] https://www.semanticscholar.org/paper/Vital-software%3A-Formal-method-and-coded-processor-Dollé/3a4a1645e672353c49d2c41718fe010c5fa2405b https://www.semanticscholar.org/paper/Vital-software%3A-Form...

deleted 7y ago
[deleted]
fit2rule 7y ago
SIL-4 doesn't generally follow the same rules as consumer computing, as I'm sure you are aware. There are track-side systems still running on 80386's, and a maintenance infrastructure in place to keep these systems running for at least a few more years, before they are replaced with the newer, Pentium-based systems. Design obsolescence is not built-in for these systems. Long-term ability to support is more important. Also, burn-in period. Many bullets (SPECTRE, etc.) have been dodged by relying on older, more proven, more tested technologies ..
- crocal 7y ago
  Design obsolescence is absolutely built-in for railway systems (safety related or not). It’s part of the fun of the profession to deal with bizarre voltages that are inherited from the 1930s. For sure it’s not something consumer electronics care for but that’s precisely the point I am making. Actually, it’s one of the required extension to ISO 9002 by IRIS, the quality framework for rail engineers. Components are chosen not only for their function but also for their supply availability in the long run. One of the things we look at is « multisourcing »: how many different folks can provide this stuff. The more the better. Going back to this great idea about hardware diversity (that is absolutely not a general rule in railway): with an architecture requiring 3 different hardwares, you essentially shoot yourself in the foot. Instead of having 3 suppliers for one component, now you need to find at least 6 for 3 components. And the probability to face an obsolescence issue has basically tripled... And for what? It’s proven useless by science... :b And as far as dodging bullets, railway is no better than SCADA. Older tech means older vulnerabilities stay in place, and there are countless people on HN that will tell you it’s /not/ a good thing. I don’t think we dodged, I think we were just lucky. There is a reason why now cybersecurity is making its way inside the last revision of standards.

noir_lord 7y ago

Out of curiously, would you recommend any good journals, magazines or books for people in your industry (grokkable by a general level programmer ideally but not that bothered if not). I find all the different domains of programming endlessly facinating.

fit2rule 7y ago
Alas, its a very academic and dry field in terms of interesting literature, but you can definitely learn a lot from a few books .. Safety Critical Systems Handbook: https://www.elsevier.com/books/the-safety-critical-systems-handbook/smith/978-0-12-805121-4 https://www.elsevier.com/books/the-safety-critical-systems-h... IEC 61508 Compliance Guide: https://www.perforce.com/resources/qac/how-comply-iec-61508-standard https://www.perforce.com/resources/qac/how-comply-iec-61508-... ISA Safety Series: https://www.isa.org/standards-and-publications/isa-publications/isa-books/find-books/compilations/safety-book-series/ https://www.isa.org/standards-and-publications/isa-publicati...
- noir_lord 7y ago
  These look interesting, Thank you!