3 ms·

so the problem with "DO-178" OS like vxWorks or ghs is that it's not DO-178. it's a version of the OS that has artifacts to support getting your produce DO-178

by fargle 3y ago

so the problem with "DO-178" OS like vxWorks or ghs is that it's not DO-178. it's a version of the OS that has artifacts to support getting your produce DO-178 certified using it. It's DO-178 "certifiable" maybe. if you need to certify one million lines of OS and a 1/2 million lines of your application, it's handy to have that first bit done for you. Until you find that you have a 1/2 million lines of code that interface with the OS. so we're _done_ with this crap. say we have a 1/2 million lines of our application and 50,000 lines to talk to our hardware, and less than 10,000 for a simple executive. I don't need your scheduler (which doesn't work right), your compilers (which are just buggy old out-of-date ports) or your IDE which is just buggy, old, out-of-date eclipse with a plugin and branding. And I don't need your DO-178 artifacts for a million lines of buggy OS code when I can replace it with less code than that it takes to interface with your bug riddled OS. And when you buy the DO-178 version, don't think it means "has less bugs". DO-178 means that it has specific artifacts including MCDC coverage against requirement based tests. All of that is very expensive. None of that means it works right. If you put your money into checklists and process, guess how much is left for "making it work right". Garbage. If you are responsible for safety-critical software, then you are responsible for safety-critical software. Paying a 3rd party for part of the responsibility would be nice if they took any responsibility, which they don't. So, in conclusion: Pbththththh!!! on the snake oil vendors of safety magic.

Veserv 3y ago
What a bizarre take. Basically every serious commercial and military aircraft design and systems upgrade in the last 20 years voluntarily uses a third party RTOS for basically all critical flight systems demanding a DAL Level A certification. Those same certified systems have never once been implicated in a single commercial aviation fatality over those 20 years resulting in 9-12 9s of software reliability (depending on how you count) for those software components which is positively ludicrous in comparison to what is considered the gold standard in regular commercial IT software. You also assert technical specifications that bear no resemblance to normal reality in the field such as 1 million lines of OS (you are generally off by a factor of 10 to 100 depending on vendor) or 1/2 million lines to interface (again, off by a factor of 10 to 100). Maybe such a thing might happen when working with a second rate vendor who does not have any real proven history or actual in-house expertise at making high criticality systems selling you a bill of goods about "certifiability"?
- fargle 3y ago
  I have worked with both vxWorks and Integrity, both DO-178 and "standard" version. Both products, both vendors, are absolute garbage. But the certified ones are actually worse because they are frozen. As far as the "semblance to reality", no that is real. Interfacing to a complex product is complicated. It's simpler to just get rid of driver models and layers and just avoid the entire thing. If you are DAL-A, then why not just be a foreground-background task and skip the "value added" OS layer. It's more reliable, and it's orders of magnitude simpler. And at the end of the day, the integrator is responsible for all of it anyway. So i'd rather be responsible for 1-2 orders of magnitude less code than some unresponsive 3rd party and their crappy RTOS. And make no mistake - both vxWorks and "Integrity" are not just unresponsive, but absolute garbage. They exist because of ONLY checkbox compliance bureaucracies. You can quote all the "9's" you want - those nines were bought and paid for by the integrator, not the RTOS vendor. Take the F-35 for example. It's one, and not the only one, that has eschewed COTS RTOS middleware.
  - Veserv 3y ago
    That is a weird choice of example because the F-35 avionics software literally runs on Integrity-178. https://www.ghs.com/customers/lockheedf35.html https://www.ghs.com/customers/lockheedf35.html
    - fargle 3y ago
      https://www.lynx.com/press-releases/lynx-mosa.ictm-selected-for-f-35-lightning-ii-mission-system-avionics https://www.lynx.com/press-releases/lynx-mosa.ictm-selected-...
      - Veserv 3y ago
        You have literally linked a press release stating a F-35 system upgrade program has chosen a COTS hypervisor. Still completely the opposite of your claim that the F-35 program has eschewed COTS RTOS middleware. For that matter, I have not used the vxWorks system, but I have used the Integrity system and literally every one of your technical characterization generalizations (1 million lines of OS, compiler is a out-of-date port, IDE is a Eclipse plugin) is wildly incorrect. Do you care to say the actual truth on any of those to show your actual familiarity on the topic?
mdekkers 3y ago
Please stay away from any safety critical systems, thank you.

by fargle 3y ago

Veserv 3y ago

What a bizarre take. Basically every serious commercial and military aircraft design and systems upgrade in the last 20 years voluntarily uses a third party RTOS for basically all critical flight systems demanding a DAL Level A certification. Those same certified systems have never once been implicated in a single commercial aviation fatality over those 20 years resulting in 9-12 9s of software reliability (depending on how you count) for those software components which is positively ludicrous in comparison to what is considered the gold standard in regular commercial IT software. You also assert technical specifications that bear no resemblance to normal reality in the field such as 1 million lines of OS (you are generally off by a factor of 10 to 100 depending on vendor) or 1/2 million lines to interface (again, off by a factor of 10 to 100). Maybe such a thing might happen when working with a second rate vendor who does not have any real proven history or actual in-house expertise at making high criticality systems selling you a bill of goods about "certifiability"?

fargle 3y ago
I have worked with both vxWorks and Integrity, both DO-178 and "standard" version. Both products, both vendors, are absolute garbage. But the certified ones are actually worse because they are frozen. As far as the "semblance to reality", no that is real. Interfacing to a complex product is complicated. It's simpler to just get rid of driver models and layers and just avoid the entire thing. If you are DAL-A, then why not just be a foreground-background task and skip the "value added" OS layer. It's more reliable, and it's orders of magnitude simpler. And at the end of the day, the integrator is responsible for all of it anyway. So i'd rather be responsible for 1-2 orders of magnitude less code than some unresponsive 3rd party and their crappy RTOS. And make no mistake - both vxWorks and "Integrity" are not just unresponsive, but absolute garbage. They exist because of ONLY checkbox compliance bureaucracies. You can quote all the "9's" you want - those nines were bought and paid for by the integrator, not the RTOS vendor. Take the F-35 for example. It's one, and not the only one, that has eschewed COTS RTOS middleware.
- Veserv 3y ago
  That is a weird choice of example because the F-35 avionics software literally runs on Integrity-178. https://www.ghs.com/customers/lockheedf35.html https://www.ghs.com/customers/lockheedf35.html
  - fargle 3y ago
    https://www.lynx.com/press-releases/lynx-mosa.ictm-selected-for-f-35-lightning-ii-mission-system-avionics https://www.lynx.com/press-releases/lynx-mosa.ictm-selected-...
    - Veserv 3y ago
      You have literally linked a press release stating a F-35 system upgrade program has chosen a COTS hypervisor. Still completely the opposite of your claim that the F-35 program has eschewed COTS RTOS middleware. For that matter, I have not used the vxWorks system, but I have used the Integrity system and literally every one of your technical characterization generalizations (1 million lines of OS, compiler is a out-of-date port, IDE is a Eclipse plugin) is wildly incorrect. Do you care to say the actual truth on any of those to show your actual familiarity on the topic?

mdekkers 3y ago

Please stay away from any safety critical systems, thank you.