Re: Need help with PowerPC/Ada and realtime tasking

[Ken Garlington <garlingtonke@lmtas.lmco.com>]

JP Thornley wrote:

> If you demand a correct/safe implementation in code of a flight control
> system from requirements that are incorrect/unsafe then what steps
> would you take to achieve it?

Actually, there are some things that can be _attempted_ at the implementation
level, although your results may vary:

1. You can have the system stop processing when an unexpected event occurs,
such as an Ada exception or a hardware interrupt. This assumes that denial of
service is not a safety-critical event in itself, of course.

2. You can create a "kernel mode," representing a subset of the requirements
that are absolutely necessary for safe operation. Using some means, such as
an operator input, you can cause the system to stop processing all code not
in the "kernel" when a fault is detected. This approach works on the theory that the 
code in the "kernel" is used frequently, and so have a lot of test and operational
time. Conversely, the "non-kernel" code is used less frequently, and therefore
might have a potentially higher risk of a fault (either due to code
error or requirements error) than the "kernel." Clearly, the reversion to the
"kernel" must be done in an orderly fashion, with appropriate operator feedback.

3. You can use checkpoint/rollback techniques to try to overcome input errors
that were not adequately caught by the required input checking. I'm skeptical
of this approach in a dynamic environment, but there's a lot of literature
available on this type of technique.

Personally, I think it's better to use failure modes and effects analysis on
the requirements, and do FMET testing after development, than to depend on this
stuff. However, some of this might work in some areas.

-- 
LMTAS - "Our Brand Means Quality"