Hello and good evening. It's 6 p.m. so this is the last talk in this room for today and yeah
I think let's go on time.
This one is on perfect. I can hear myself. Good. Thanks for coming. I see at least double
the number then three years back when I gave you talk about safety critical Linux topics
and so on. So thanks for coming. To give you a bit of background to I am. I work for
ETAs. ETAs is not known for too many. It's a subsidiary of Bosch Bosch most likely. Everybody
knows we're mainly doing automotive solutions. I'm an open source community manager there
and I'm also responsible for automotive open source software processes which means how do we
get the different open source projects into an automotive development and violence
which also leads a little bit into this topic. I am no longer time participant in the
release project and I believe safety application which is basically also there to bring
Linux into safety criticality. I'm the chair of the technical zero community there. I'm
a member of the board within Linux Foundation Europe and I'm also within the Clips SDV
a computer for the safe open vehicle core project which will also heal like one or two slides later.
Does it? Like this? Okay. Good. I take it like this and the last thing is that I'm
a long time open source and see the S10 promoter. I want to give first question like what
is functional safety so for those who are here who know what functional safety is and
also know the difference between functional safety and cybersecurity? Good. There's a few who
don't bring the background so just briefly look into the definition of safety that the freedom
from unacceptable risk of physical engineering injury are of damage of the house of people directly
or indirectly because of damage of property or the environment. Basically you're hit by autonomous
car then it's safety or if someone steals the credit card information from your car then it's
a security thing. Then definition of functional safety compared to just safety it's a part of
the safety depends on the system or some equipment. This can be a control unit or something else
and it's also checking that it's operating and response properly to the inputs and then it's
like that you need to detect the dangerous conditions either resulting in the activation of
protective or corrective device of the mechanism, prevent hazard events, providing mitigation measures,
reduce the consequences of the hazard events. It's not to get rid of everything so you
can improve that this is arrow-free or that there's nothing but you should limit the risk that
it's acceptable and comparable. So for software parts this means the software does behave as specified,
does not interfere or impair other system components and all the events are addressed somehow or
somewhere if you detect an arrow you do a proper response or mitigation and so on and then you
need to bring a lot of evidence in there. Once more here save but secure, secure, not save,
an emergency access which is not the emergency exit would be the place for safety.
Putting a login front of it make it secure but it breaks safety. On the left with you see the escape
letter that's the safety part of it. You see in the top row there's a door open. This can be
potential intrusion than this breaks security just as differentiation once more making it clear.
There are numerous standards out there. I mainly in this field here of the IC6508 and the
ISO26262 they have a little broader frame which is hardly detectable. At the end it basically
standards mean best practices. They mean the shares similar demands like requirements documentation
testing, they define a certain rigor which you have or which measures you have to take and
it also means that you need to know all the system parts test it and manage.
Setting the scene now really on the content. Well in the enabling Linux and safety application project
we may look into Linux there are many more projects operating systems but we basically come from a very
regulated environment. It's like safety buys a book for operating systems. There is the
experts, Q and X you may remember from the Blackberry Handys and smartphones. It's still alive
the Q and X is now one of the major operating system in cars. Safety criticals and safety for
safety certified green holes integrity is another one of these so they are broadly used. They fall
the traditional approach but it's also hard for them to keep up with modern development and speed
which you have they don't have broad ecosystem and there's then the different to we now look at
so with Linux if you're just type searching and you are preferred search engine and look for safety
Linux safe Linux Linux in safety you will find easily all these kind of different articles and as you
can see the presentation is called Code Compliance Confusion because there's so much marketing
information and partially wrong parts in there so that I saw it bringing this in and that it
basically means if it's me and save X whatever it is safety X X we're safety still qualified it does
not really tell you what it is in the end. But Linux for example is super attractive to be used
many of us most likely have it already on here devices using it there's almost no way around it
but that's just some part of it. The broader ecosystem I tried to cover a little bit here
so you see there's in the automotive there's a middleware stack but when the application and
the operating system like auto wear and there's eyes rigs there's the clip safe open vehicle
course it's all these purple colored ones we have broad initiatives which are building up more
system ecosystem like the these are so few part. Compilers are there with the safety critical
rust consortium and the LLVM qualification group there are frameworks like trustable software
and so basically have this and in the description of this talk I think I have most or a bunch
of these links and there are otherwise just church for the name and what they have in common
that they all try to get in a part of the safety certification or try to be safety certifiable
and this means sorry for all these numbers if it's new for you but that's what you typically
will find there's the IC6508 and the roots re-ass means this is a pass if you don't
develop software directly by you have pre-existing software which you try to bring in to qualify
it tells you super simply flight that you basically do with your pre-existing software the
things which you would also do with your own software which you write but you already have it so you
will check for requirements great traceability do the testing where testing is not so established
you have to do a lot of things in the ISO 26262 there is the in part 8 there is close 12
which is also for pre-existing software and there's also where something already starts
because this is originally meant for I would say less complex components libraries also on
so if you want to apply this to a huge set of parts this will be two complex to really follow
the principles there is a rework on this on the third edition with the ISO Pass 896
you will hear this here and there's a skips a more formula approach to pre-existing software
and you're often when you want to deliver something you create a product an element which means
it's some part of a whole system and this is called a safety element normally called safety element
out of context that's how the ISO describes it we will later under and that there is nothing
such as an out of context because you always have at least in the same context
and then of course you need to go for safety element as part of your existing software
so you still have to do all the work which would anyway do for software like writing test cases,
specifications, requirements and so on I don't want to put more on this slide because I
thought like nowadays AI is basically readings through all the things we prepare and when I asked
AI on some things upfront based on the model they were quite strange answers saying for example
that VX works as a safety certified Linux which is not the case but it's just like if things
are on the wrong page so therefore on the another one there are another routes to safety
certification which are more like to be handled with care there's one thing which is called decomposition
which basically means you have the safety part and some part which are not safety and you try to
isolate the safety part and make an argument that you do not need all the safety work for the other
parts which you're doing because you have sufficient mechanisms and this is actually coming
practice it's not the bad thing but it still remains that you have to do all the safety work
just at another part and you need to have a really good argumentation why it's not interfering
like that the things which are non-safety critical will really operate as they should
yeah and this is then also causing mixed criticality what it seems it would basically mean you have
your if you would consider a car and you would bring in some gaming engine I think on Tesla you can
play games also there like controllers for playing it imagine that would be the auto system running
in parallel to the games console thing and experience game controller and there would be any
interference between the game controller and the car you need to really make clear that this
will never interfere and that you do not start controlling your car with the game controller
when you have the same event maybe a little bit but make up but it's like mixed criticality
if it's in one system and environment very questionable already is like tool qualification the
tool can be a compiler it can be a requirements tool configuration management documentation
GitHub would be a tool when you host your environment in there and you need to say like
this is safety critical and for software as such if you bring it into your device it's a
you want to break an auto system you wouldn't go to before tool qualification but there are
actually libraries out there which claim to have these kind of things so they say we have an
highest level of safety integrity with this according to tool qualification while they're actually
not tools but embedded software and then the last one where I'll give also an example on this
as in part eight there's a plus 14 and the ISO is called proven in use and many would say well
Linux is proven in use right because you will find Linux everywhere Linux is on Mars
Linux is in cars Linux is in small rotors up to fancy devices desktop super computers
it's proven in use right and would even see this for example in cars in in China so the
Chinese cars build up on Linux to do driving a system but still this does not mean it's proven in use
proven in use actually means that you have proven this in the past and you take it over to
next generation of a product or something similar and here what but where you can make use because
it's not proven in use what you have in Linux as you have arm x86 architecture where you run it on
maybe a risk five we have 32 bits system 64 bits systems you have completely different configuration
hardware devices you can argue for diversity and say well here's not only one Linux I bring in
four Linux systems in parallel and then I run my safety workload on top and say it's very unlikely
that all four Linux system will crash at the same time and whoever tried to reproduce an error
like in a product it's almost oh I have this and then you go to another desk and it's not
for many cases you simply cannot reproduce it directly but you have to look for it day two three
four five until you find something and two devices do not behave the same way so this is more
diversity argumentation and then you can say okay when something goes wrong with my three
two four systems I will detect it and then I have an argument for diversity this is basically
then also decomposition which you're doing and say I don't I can still make a step use of a standard
Linux but the rest fits yeah so therefore whenever someone comes with a proven in use argumentation
if this what is proven is not proven in safety before and it should be used for safety don't
accept that this would be problematic the other question of part which I was mentioning is for
the tool qualification I want to give the example of the cute safe renderer because some
use case which we analyzed who if you have a car or a e-scouter or something like this
if you have it at home and you look into the car or if you're driving license you know that
there are these warning signs in there which told which gear you have they make a check engine
oil pressure water pump whatever this is actually a warning indicator and you need to make sure
that this whatever is really coming because it's safety critical at the end right if you're not
knowing if you're in front gear or in reverse gear if you don't know when the oil pressure is
going to high if it's not indicated so therefore you need check why I'm telling what you typically
do is you check whatever is there in the display and this is done for example by hardware checkers
and you really read what's written out the cute safe renderer says I do save rendering whatever
you give in I process properly and it's get out and then it's just written to the frame buffer
and from the frame buffer you do know what happening because the frame buffer needs to get
process to the vision pipeline into the screen and you need to see that what's things are really on the
screen so they claim to do save rendering up to an asyld and if you look into it you figure out
they treated as a tool rather than embedded software and the good thing about it it's not causing harm
to anybody because you would any day take additional measures because you secure your safe
safe your pipeline from frame buffer to the display but you may pay for something you don't even
need and you get just something wrong and this is like a marketing activity for all the motive
but for railways for example it gives you safe rendering for signaling and there such a library
can make sense but then it's not the tool qualification of here for all the motive also but it's
more a tool qualification for signaling displaying or maybe for medical devices this can also
be helpful so be aware of the use case if we look like for a concept system architectures
how Linux or operating system getting deployed you need to choose the system where you want to go
to so if you look into modern architectures so this architecture was as basically on the left side
safety allocated to Linux that means you really work hard and trying to argue why everything is
fulfilled from the Linux side that's something out there in the automotive space another way which is
more spread and existing since many years is that you keep the Linux as a standard Linux for example
and give more responsibility to real time or as this can be for example it should be a 351 it
could be also bare metal application something like this the reason in the middle it gives you more
control you can control things and you get more independence but you need to it in the
additional part right you need to get a microcontroller and intelligent one you need to get the logic
and the artisels while you can see on the left side if you real the brings the responsibility to Linux
you can save this part and maybe just end up with a very good external challenge response watchdog which
is just making sure that your workload is properly executed in data tech when something hangs
something we also see in the open quiet often is that you put a hyperwider underneath that's a
third architecture and there you give them safety focus and safety monitoring all these kind of things
into the hypervisor and therefore you have more control you can have access on caches you can steer
the caches you can give control like for memory parts how control the CPU restart systems and so on
this makes it attractive but of course you need to make sure that the hypervisor runs all the
different architectures and it could be that you have the one as you see which runs Linux perfectly
but you get just limited support on hypervisors there or as they can when that does not want to support
your hypervisor could also happen so this is like why say choose your battle wisely you need to see
what's your application what you're planning to do what do you want to achieve where do you see
the complexity is the lowest and best fitting to it any pattern of these solutions there's always a
watchdog involved I would say because you need to make sure that when something fails you detect
if a system part hangs then you would go for any kind of watchdog and this is not that you really
want this or you expect that the watchdog is triggered it's your ultimate safety net so if you do a
proper system design the watchdog will never get triggered this is then moral inequality issue
imagine you will have your MOI phones in the past ten years back Android system sometimes hang
and then they would restart know what I see you expect that the system runs for a month or two or
whatever who is out any restart necessary and this can be something where it's still stable that
there is no reset in the software anymore and that your system you're watching or so never get triggered
and that's something you should see so it's always an intended functionality some kind of
monitoring of this functionality and then make sure that this monitor also operates properly
that for example if someone stops the CPU it's not causing a harm yeah who more to trust
than in the end for these kind of architectures and it means like even if you do decomposition
even if you're an environment where Linux has less responsibility it's like can you say now from
this image who is the best candidate whom you would trust to be on this rope and never go down
the safety net while you can say it needs training where you don't know if maybe the left person
is the one as the same person as in the middle or if it's just giving you anything so that's why
evidence qualification trainings proven history on things are there and therefore example other
artists on a rope which give you much higher confidence that they will not fall down and
may not even require because they have built in elements also to protect that there and this
shows you like you need to really understand where the system is going and what you what you will
do comparable also like for freedoms for interference I gave this picture because before where
things can violate each other and if you go in an arm architecture there's an armed trusted
which is the security functionality it basically makes sure it's handling certificates and so on
and you can use opti with trusted applications to store things and it's assumed that the
trusted application has an intrusion detection and the trusted application sends the command to the
armed trusted firmware which is below CPUs and tells this CPU to stop then for security reason
this is perfectly but if you run in a mixed criticality environment with different use cases
this would stop then your whole environment and you would not even have scheduling so your workload
will not work anymore but therefore it's like you need to see what's in there and you need to understand
the thing and what it means to understand the system part are I'm building a bit on this because
it's good for the understanding what is the probability that a car will fall on your hat
on this room it's very unlikely but maybe you're building a product for a different environment
right and I guess here the risk is much higher and that's also why these lifts for cars in
workshops have certain certifications checks controlled and that it's not unrealistic that's
such a car can fall on yet you can just also search in the net there are mentionedings where
these lifts were not working properly where the car was not secured to just somewhere
rolling down and somewhere people were seriously injured so it really means like what is it about
and now finally to the code part we have various approaches existing and basically it means
for example you enable safety afterwards that's a lot of things which we touched so you have
approaches how you get forward but you can also go for more secure environment where you say
you have a security footprint critical industry is project some projects start with certification
in mind from the beginning you may have more control about environment it's super hard to
control it in experimental containers if you tell them now we want to write
established traceability to test cases and write on requirements it will be a long pass
and hard to convince them while it may be much easier for a small project which has already
used in very secure environments and several parts whereas the community smaller
school sizes smaller and other parts um last thing is where certification comes in before going
open source and that project which I want to mention here overall so the first example I bring
in is the consent project from the Linux Foundation they came with a good security background
strong footprint over there and it was already widely adopted they have a good traceability
multi-ci pipelines and so controlling this part and the community brings the quality awareness
so this was possible for them to work and say like okay we switch up dynamic memory
allocation because this is something which can cause issues or we follow misragued lines as
static analysis and follow the rules there to try to improve our stack and this is working
there so they have an easy way forward another one to be mentioned is Zaffer Artus there's also
safety certification part there and it was also considered from the beginning that there is
safety certification considered but what we have it's a wide-wide-wide use case range and
many of those using the Artus don't require functional safety so it's much harder to convince
the community to follow all these kind of practices and therefore that's the challenge is
really the heterogeneous community non safety critical use cases but still there have been misragued
checks starters we can start with certification of code subsets that you are not influencing the whole
environment there is the traceability and requirements with strict doc so Stan was bringing this in
and Nicole you're also an audience so you're yes Stan's also yeah yeah that's all right
so this is what we see that there's actually acceptance on this making progress here you can see
that the IC650A road 3S is a safety certification pass primarily which will not limit other
use cases but that's where a scope comes in I don't know if I put it in here for extent it's also
in this direction and I have also the FRE I don't know you're also here so for from can concept
this is a kind of single vendor open source and this thing is that they have ownership of the
code it's open source and it's also like not only safety it has a high degree like BSI
certificate certified for also cyber security parts and they have a full control so it's easy
to change processes to establish how the rules and to bring this forward and they also have to
safety and security mine but it much harder to create a community because they may fear a certain
lock in that it's not spread how to contribute and so on also it's more costly for a company
if there's not a sponsorship of a foundation to bring this forward so there's higher effort and
there you know I call it soft lock in which can happen because you people may think I'm dependent
on this company for this open source project while if it's under a foundation I have more control
like if we go for Hashie Corp things it's more the extreme case where the change license also
then they move open to through there instead of terraform and so this is something which you can see
yeah this is just to know still this is another option which you can bring as so as an hypervisor
part then we had this doing the hard thing before there are thread acts as a contrary to the
zeffer it's on under eclipse foundation and it was Azure Artals before so Microsoft donated this
project they have safety certified it and they also plan to go forward with it that it's continuously
safety certified but now suddenly the process which they had is not made for a community so they
didn't have open source community in mind when they started so they need to see how do a handle
contributions how do I actually finance future certification when this big company is not in there
are there enough members will pay for it the liability because normally when you buy such a safety
certified product you get also set of liability and in the automotive the companies actually ask for
unlimited liability which basically can kill your company and if you're not subscribing to it
and say okay it's not you don't sign say that's okay for me they you will not get to job
so therefore this is something to be answered how will this work with an open source foundation
because if an injury would happen and there is an incident you don't want to kill the whole eclipse
foundation just because of one crash right so this is something which you need to
make up your mind and the measures they have taken they come up with certification organization
they have a commercial model behind and that's it and approach a little bit to bring the
things together is done by the eclipse safe open vehicle core project as an example so
they came like with the automotive focus so it's mainly automotive members in there
so they already come from background from the security and safety they have the knowledge about it
and it's targeted for automotive so it's not that we have a why use case they also start from the
beginning with the process so that you have certification in mind therefore the development process
is more mature sometimes may contradict with some open source flavors but as they mainly
expect automotive contribution this it's also not a big issue as it's under foundation they
overcome this single vendor open source thingy a little bit so the eclipse foundation helped them
to have a neutral governance and yeah regarding doing the hot thing before a lot of these components
which are brought in are discussed and have been previously used in safety critical products
however you really see that there is a big clash then of the world because suddenly you have
contributions they come from automotive but they still miss the open source understanding like
how to collaborate on poricvers how to do the reviews how to act and be excellent to each other
how to not mix things internally and externally and that's more than the open source environment
the open source licensing but still many who just bring open automotive professionals rather
than open source professionals which you would find in a community and then also the last
part is that they over don't want to take a certification there they just bring things to make
a certification ready which basically means you forget all the artifacts all testing everything
you would expect but not the certificate which we would need for a product this is then handed
over to a distributor a distributor would be like normally sous a rat hat canonical right they
provide you with Linux distributions here it would be automotive companies which take this up
and they then also take over the liability most likely with the reinsurance model or so because
also they have hard times in doing unlimited liability and by this it's a little trying to overcome
all these different challenges right and then as the repeating theme you really see that from
all the solutions which we have it's not fully open everything because open or safety critical
software is expensive it doesn't come for free and if it's completely for free it's hard and I make
an exception because for the ferocene so if I draw a scompiler Florian always tells that he basically
has everything open there while you hear from a bunch of people they also like this can easily break
his business because everybody can just build on it if you see everything there and again
a compiler falls on a two qualification parts it's also some different things you have to do there
so but but that's just something to mention what you always have is source code available
and this is actually already a change because for traditional safety critical environment
you're not supposed to have anything at hand so if it's really proprietary you'd get
binaries and a manual how to use these binaries so we have no control about finding bugs or issues
and so on and even if you would have seen something you maybe have hard times to send this back
and we see that the updates come in that this is an important thing we had in discussion with
Linaro guy who is responsible also for scheduler in the Linux kernel part and he said he was called
to proprietary development and should have a look at the scheduler because he was in a company
and then had some of the interaction and said that it was it was not the safety certified compiler
but it was more critical environment compiler for everything and he said he took 10 minutes to find
the back in the compiler which will cause something to fail which was just like a closed environment
and I don't want to say that there is anything out there which is previously certified
things but you cannot make sure that there is not such a buck which can come in there it's really
hard to prove this especially because you certified this proprietary software once typically
and the hardware evolves over time right imagine like how much performance a PC or phone
had 10 years back what they can do now and imagine your software wouldn't have evolved over time
on the memory management and so on he would have would be still bound to for a gigabyte of
memory or something like this and this is basically the environment of a bunch of proprietary
solutions because this certification is expensive you have to find the experts and so on but this
makes it a really hard job to move on and that's why people would like to go over this open
source because there is evolution and things going on then the second part is that you have
really limited view on tests, requirements, traceability right you just get your manual and say
in best case they tell you our tests have passed you may be also don't wonder need this because
you say anyway have the liability of it but it also prevents you from getting a full understanding
what's in there so therefore this is something which is in the proprietary world but you will
also find this already in these project because I say we do so much effort on testing in the open
and we have so much effort in making it safely soluble so we may give you not all the artifacts
also for open source projects to just come into like a business case topic yeah and typically this
is then also through membership fees if you look for a zephyr for example you become a
premium member you pay money for it and then you get access to all the things and you can all
steer an influence part and even if this cost money it's comparably cheap to what you would normally
pay most likely for your commercial artists environment right and the other way to secure
your business is to create a service around it so you bring in open source you say this is
safely soluble and usable but you provide additional debugging and all of this diagnostic tooling
and SDK and so on you do the maintenance the updates and this is something how you
create the native on business and start to refinance also as a company because they need to be also
an interest in the company within a distribute or also in taking this open source base to bring it
forward and if you would consider to say like I go in a safety critical space with open source
make up your mind before how you make money out of it and how you finance the activity and keep it
going right what's also quite good to see I haven't touched this which can help is that you bring
like a premium model that you provide all the things you need as an open source environment
if you go or I would take redhead as an example the redhead has a redhead in vehicle as
which is a proprietary solution based on an open source of the observative but there's also the
auto SD which is a derivative then from the centers and therefore you have then something to
try out right everybody can try out auto SD can build would be even able to re-certify things
based on the auto SD environment which is close to what the rivals does but of course you may
pay then better a redhead for giving you the service and the liability similar like you would
do in your normal desktop or enterprise environment why you would go maybe with redhead as a provider
but if you say like okay I basically need the environment I trust in what redhead is doing
I may go for anomaly nooks instead right which is also then the base here so the business which
come in is liability certification add-on the SDK IDE customer support maintenance is a main part
right why have I told all these kind of things on the concept methods is also that you find
so much marketing is information out there so if you really go out and look for this
um people will start really telling this is safety certified it's an asyl whatever
as soon as you see an asyld which is a highest safety level always be careful to look at it
if it's like a very huge code base try to figure out where it is make logical checks in there and
um do not directly trust in what they're trying to find the certificate see which part of
standard the certificates are are four and also is there an assessment report for example
like you will find linux assessments reports for I mentioned redhead code thing is also out there
and their assessment reports are downloadable from the exceter assessor right and that's basically
what I said like wording does not tell you what it is and uh the industry and the safety standards
are very very much regulated there's writing for everything the assessors know what to do this is
very close but in the open what kind of comes to marketing nobody clearly defines the limits
what to be used which words to be used and which not and then um yeah when you then go out
and you find some news out there what they do or if you have a company or in charge with
going there so like what is actually the contents where do you use the system
uh is the sufficient what I want to achieve check where the safety is allocated so maybe they say
whether I have a safe linux but actually it's domain safety work is done by uh the hypervisor from
the cancuncer people so they do the actual safety work and they make it sure and the or above
it's just like a standard linux this could be something all right so let's actually look
looking to the part the assessment and see what else is there is their additional security certificates
which can help you in having a good feeling on the quality they deploy and uh always check
what's your safety net so don't go on the rope without having a sufficient confidence that you
will survive when you fall down right it could be a narrow rope you may avoid it but if it's a
high rope better look for these kind of things uh last word before I would conclude it's like
my really personal view nothing about my employer or any environment not the projects are
for me as like we had ten years back there was a lot of security by obscurity and we learned that
security can be the best in class when it's open of course we find things we find bugs there we find
vulnerabilities by we fix them and we have a chance to go forward and we are still currently in the
phase where we define safety by obscurity not that we say that's the reason why it's safe but we
prevent the view and you can make a very simple example you can say will my system be less safe
when I get the visibility to the source code or will I have the possibility to make it safer because
I have access to more information and the main reason why people put this behind is like they have
IPs behind they have patterns they bring all this in they spend a whole lot of money and they
have the concern that they will lose all their business and the money by not opening it and this
is then put over the uh environment of the people right so basically that's where they open really
benefits in and yeah for the community side and to finding this taking the linearer guy who looks
into the compiler part like where we have the crowd intelligence it's like there's a thing if you
want to to go fast go alone if you want to go far go together and I guess by this I will conclude
an open for questions
you
anyone oh yeah this one in front
right just to I don't know if it understood you correctly but proven in use would not be
good enough if I say but it's you boom to debut and it's used by a lot of people right
exactly so you can say for you personal private use whatever you would always say it's proven
news and that's why I'm choosing it but proven in use is basically there imagine you would go
from one generation to next generation of a product and you don't want to do all this
re-certification and testing and so you have an untouched software past library and you bring this
to the next product then you can say this is proven in use until the assessor see I haven't modified it
and here come the catch I don't know if you have ever read about the Ariana 5 rocket
which exploded during stars it was not a safety failure at the end everything behaved
properly but I think it's was an overrun or something from a timer volume which
where it was showing then a speed of speed or something they couldn't explain it the safety
maker isn't attached to it said okay something is completely wrong or so and then they do the
emergency explosion of the rocket it was basically something like this so it was proven in use
technology for an Ariana 4 but this Ariana rocket was having a different software environment
component part I don't get the full audience to just check for Ariana 5 software issue
and then you will find this and this is basically taking over existing software to a new
generation believing its proven is as it shows your whole complex things also be very careful
when you ever come to proven in use augmentation that your assumptions haven't changed that
everything specification wise is really similar and that's why it doesn't work for a gabion
you go into it so but is it debatable I mean if you look at some of the standards they're
quite open for this intervention right yeah this this is also a great question because
the standard doesn't tell you directly and we were talking here about safety integrity standards
and there's a fundamental difference between safety integrity standards and safety standards
safety standards for toys will for example tell you that your teddy bear or doll shouldn't
inflame under fire like 30 minutes on a fire or so it gives you clear conditions what is allowed
what is not allowed and what you have to prove and the safety integrity standard will tell you
measures cyclomatic complexity and it will never tell you it should be 5, 10 or something
actually it doesn't even tell you that you should measure cyclomatic complexity I at least
notice safety standards I'm aware of but they they say like to branch coverage or other parts
so this is something which they mentioned but they don't give you the rigor of it and then
it's your part of arguing a why it is like this and when the assessor has the evidence and they
will say okay I believe that all the processes which you're doing as properly and don't believe
that the assessor also can understand everything because this would mean they need to have the
process understanding the technology understanding and everything they cannot have a full system
understanding of everything but they do checks, bot checks and the area I'll see that you have
that they have a confidence that you do everything properly that you bring the right qualified
people this is all the things they can check but they cannot really give you 100% guarantee that
what you have done that you didn't miss it so if you miss that the rescuing need to float
if it's not your requirement in somewhere you can still be completely process compliant
it will just not rescue the people it's obvious that you will not miss this but
this Swedish government was making a request how many language they should support in their
official governmental model so they was a ticklist and they almost forgot Swedish
in the list of languages because they were I mean it was super in the article that they have
Swedish in there so it was like what language should we support English Polish German Italians
Spanish so they gave this list and they let the people vote and see like how many language do we
actually need where they demand and they almost forgot Swedish in the list as Swedish and this is just
like sometimes you just miss make something up but most likely this would be something in
all the time it's like what's no Swedish in there that's why there's a benefit also there
okay I don't like question great
so regarding your example about the climatic complexity it's not written in any standard but
I have not met any auditor that did not ask me about it I come from automotive so question is
I see a big bottleneck in this rigid auditor with traditional view for introducing
software in safety critical systems or anything innovative I want to hear your view on it
and what we as a community can do to maybe change this in future so first of all I will not
give you any number on what I see as a useful cyclomatic complexity I know that there are a bunch
of auditors and assessors which bring an outsource mindset you just need to find the right people
in there and see the environment maybe one is the next one could be directly in front of you
so not kidding and then what what we started with originally also from the user project was to go
yeah basically an open source conference talking about the topic like we are here but we can also just
flip the whole thing around and in our thing in April I will be at the two suit and present
about open source processes this is one step and I will do it also to run on September most likely
I've been to exceed up and pause you and just bringing this in so this first of all gives you the
awareness in the safety critical environment because they also have a community and you can go to
this community and spread the word you can spread the word like explaining things right it's
everybody can take a little part of it another inverse which we currently take is we try to turn it around
the open source development is fundamentally different right or to the traditional
fee model or the mode of a device device development artifacts by very similar you find requirements
in open source you can find traces you have better documentation you have better checks you have
see eye pipelines and a lot of best practices from open source of those which are taken over in
industries based on the demand based on the community which needed it and what we currently
started is we try to look for the evidence for best practices and literature existing like
open as a scorecard best practices from Linux Foundation I'll put looking into this right this down
and try to make this a standard why not a safety standard or just the quality kind of standard because
it's often says like is your base for your safety development quality managed and if we can prove
that the open source work creates the same level of quality by different measures but same
artifacts in the end or comparable artifacts we have an argument and then the processor will have
hard times in arguing like saying well yeah but you're using another quality so because it doesn't
tell you that you have to use exactly CMMI ace pies or similar right so it's something where you have
the possibilities that's where we currently also try to add an additional element in there like
from and leaves are perspective not that we wanted but I think it's it's a good thing too to
bring this forward good question we're two more minutes so it would be room for one or two
question well let's just go for another one well when everybody else is shy so during the presentation
you mentioned tool qualification yes and there okay for tool chain compilers it's clear but
you mentioned also GitHub if you're storing code there and mostly interested in all infrastructure
tuning like doctors if he was build environments yeah doctors so where do we draw the line what is
what what which tools we need to qualify in the process you think you do you do need to qualify
everything and that would be over kill but you do a two classification you see like how mature as the
tool you may sometimes even come to say like oh it brings a low complexity I can easily identify
issues also so for example if you say here is the GitHub environment and for the reviews you see
that there's a look and representation and there's a representation GitHub you have different views
then you can maybe have an argument and say that this part is not important but you may want to
look into your build tooling that the artifacts are properly fit together and then you say well I detect
all these kind of things in my testing if I detect everything in the testing I may not need to qualify
something but if you have a script for traceability then you most like you want to make testing
there because you say on the traceability there's so much dependency and therefore you do the classification
and decide what to will need this imagine you have requirements tool and this requirements
tool has a tendency to lose data entries then you may this safety critical requirements so therefore
you're a requirement tool maybe a good candidate for a two qualification and that's how you
basically bring in and I really love that you brought up this question because we have this
thing that the safety critical products are often seen as slow and we kind kind
keep up with the pace but we have a very manual driven environment with a lot of still a little
of spreadsheets, PDF files, manual signatures and so on and like if you see this SQL project this
is also developed a full automotive process and it would naturally have the tendency to become very
slow by what actually happens is that we put so much effort and tools in automation
that later on you can continuously generate all the things and the assessor will know from the
process from the environment that nothing can go wrong because there are all these hard gates and
everything around it and by this the tools are an essential element for the upcoming
environment because this is the only way to make it better understandable for the assessors
to have more assessments, shorter cycles so two qualification is the thing you need to bet on
in my perspective. I think that will be the very last question. Thank you. You mentioned
several times the significance of the environment and the context of the software in which it is
how do you approach classifying something like a library where that environment depends entirely
on the user? Yeah so I tried to answer and if I did not understand properly you can see it
from true perspective so you can have a library which is broadly used and if you would start this
library would be a safety element it can make an assumption and say I will develop this library
for being used in medical products with certain interface. Then it would be from this perspective
quite easy and you cannot bring it to other industries. The other part is like which library
will you choose if it is for the purpose but then this library most likely will never know
what you wouldn't know of your existing. If you're not interacting you don't have a contract
you have nothing. So you want to use this library and then you would most likely go into like
first to first assessment do you judge it as a fit and then you may if it's a small part go into
this part a class 12 pre-existing software and write down the requirements you have to the library
and write the test cases for it and see if everything you have is fulfilled you can go for a
STPA analysis potentially to say like how is it behaving to my inputs outputs what our hazards
what our risk which come in and you do all this assessment then use it so then you can use a
very generic library for your very specific part but you put it into the context of your system
but this library will most likely never know about your system but it's not the idea of the
library because the library would just be a library. It was not that the developer thought I built
this library for a safety critical product. The developer may say it when they want to do it but
then they will provide you with assumptions of use and say like this is how I'm supposed to be
operating from my limited understanding on your use case and that's why often things become
always in context so you talk to the hardware people to the application developer and whatever
is involved just make it in context and have more and out of context contractual and why I'm in
ways say I have guaranteed services or something like this or response times so it's becomes
more contractual seeing than a technical thing. But I guess now we are at the end thanks for staying
up to the end.