3 ms·

The rules seem quite reasonable and less strict than what I had expected. The libraries section mentions "Only DO-178B Level A certifiable" libraries. Are any c

by pmr_ 14y ago

The rules seem quite reasonable and less strict than what I had expected. The libraries section mentions "Only DO-178B Level A certifiable" libraries. Are any common open source libraries among those and is there a list available somewhere? Another HN thread mentioned that there are certified C++ standard libraries but I couldn't find any vendor of such.

fshaun 14y ago
I suspect not, but I'd be happy to hear otherwise. Certification is as much about process and traceability as it is about the code itself. Open source naturally tends to give visibility into the development process, but there's usually no business driver to spend the money on certification. Think multiple thousands of dollars per line of code.
- foobarqux 14y ago
  You cannot certify libraries.[1] The best you can do is to provide a certification kit which consists of tests to be run in the target environment and appropriate documentation/traceability. However, as the GP notes the libraries must merely be "certifiable": You can do all the certification work yourself as long as it is possible with the libraries in question. Having access to the source code and the lack of non-determinism are two big requirements that come to mind. [1] In fact you cannot even certify software only entire systems.
  - pmr_ 14y ago
    Referring to [1]: So, if I would try to sell libraries targeted at avionics there is no way for me to get certification for that specific library? Is there a way to guarantee "certifiability"? Sorry for the late reply.
- Symmetry 14y ago
  That's why the DoD loves RedHat so much, they let you pay them money for their distribution, and then you can use all the libraries that come with it.
grumps 14y ago
I don't believe they are just sitting out there like open source. I believe you will have to purchase this libraries. Just like you. However, the problem boils down to the fact that you will be developing on custom hardware, thus the libraries will probably not be reusable. Basically you have to prove that all lines of code are part of the requirements, no dead code. You will also have to prove that all code fails in a fail safe manner. I.e. the plane won't crash Level A cert is for flight critical systems, I.e. flight controls.
foobarqux 14y ago
This is your best bet. http://www.open-do.org/about/ http://www.open-do.org/about/
- javert 14y ago
  Very interesting site. Thanks for sharing. Unfortunately, it looks like it's been static since 2010.
  - foobarqux 14y ago
    I don't know why you say that; the blog is receiving updates and at least some of the sub-projects are logging commits.
    - javert 14y ago
      Well, I'll tell you why, in case you are the person in charge and can do something about it. If I click through the links at the top of the page, there is no real indication of "staleness or non-staleness," until you get to Open-DO Conference, which has material from 2010 presented as if it's new. Then, the next link ("Forge") has "Latest News" from 2010. Update: I did not even realize there was a blog, because you linked me to open-do.org/about/ instead of just open-do.org. There is no evident link to see a blog, so the assumption of the website designers must be (perhaps unfortunately) that you always enter directly through open-do.org. It turns out that clicking the title graphic will take you there as well, but someone who is initially linked to the "about" page would never think to click on that.
      - javert 14y ago
        By the way, thanks again. I'm not interested in the details of the sub-projects right now, but now that I have found the blog, my personal valuation of the site has gone from "encouraging" to "actually quite useful." I've already found interesting/relevant reading on the blog.

by pmr_ 14y ago

fshaun 14y ago

I suspect not, but I'd be happy to hear otherwise. Certification is as much about process and traceability as it is about the code itself. Open source naturally tends to give visibility into the development process, but there's usually no business driver to spend the money on certification. Think multiple thousands of dollars per line of code.

foobarqux 14y ago
You cannot certify libraries.[1] The best you can do is to provide a certification kit which consists of tests to be run in the target environment and appropriate documentation/traceability. However, as the GP notes the libraries must merely be "certifiable": You can do all the certification work yourself as long as it is possible with the libraries in question. Having access to the source code and the lack of non-determinism are two big requirements that come to mind. [1] In fact you cannot even certify software only entire systems.
- pmr_ 14y ago
  Referring to [1]: So, if I would try to sell libraries targeted at avionics there is no way for me to get certification for that specific library? Is there a way to guarantee "certifiability"? Sorry for the late reply.
Symmetry 14y ago
That's why the DoD loves RedHat so much, they let you pay them money for their distribution, and then you can use all the libraries that come with it.

grumps 14y ago

I don't believe they are just sitting out there like open source. I believe you will have to purchase this libraries. Just like you. However, the problem boils down to the fact that you will be developing on custom hardware, thus the libraries will probably not be reusable. Basically you have to prove that all lines of code are part of the requirements, no dead code. You will also have to prove that all code fails in a fail safe manner. I.e. the plane won't crash Level A cert is for flight critical systems, I.e. flight controls.

foobarqux 14y ago

This is your best bet. http://www.open-do.org/about/ http://www.open-do.org/about/

javert 14y ago
Very interesting site. Thanks for sharing. Unfortunately, it looks like it's been static since 2010.
- foobarqux 14y ago
  I don't know why you say that; the blog is receiving updates and at least some of the sub-projects are logging commits.
  - javert 14y ago
    Well, I'll tell you why, in case you are the person in charge and can do something about it. If I click through the links at the top of the page, there is no real indication of "staleness or non-staleness," until you get to Open-DO Conference, which has material from 2010 presented as if it's new. Then, the next link ("Forge") has "Latest News" from 2010. Update: I did not even realize there was a blog, because you linked me to open-do.org/about/ instead of just open-do.org. There is no evident link to see a blog, so the assumption of the website designers must be (perhaps unfortunately) that you always enter directly through open-do.org. It turns out that clicking the title graphic will take you there as well, but someone who is initially linked to the "about" page would never think to click on that.
    - javert 14y ago
      By the way, thanks again. I'm not interested in the details of the sub-projects right now, but now that I have found the blog, my personal valuation of the site has gone from "encouraging" to "actually quite useful." I've already found interesting/relevant reading on the blog.