News for hackers. Stuff that matters.
Re:Killed by a Machine: The Therac-25 by wyldfire on Monday August 01, 2016 @10:19AM (#12202536)
> They wrote code that depended on hardware controls

...similar to Toyota's electronic throttle control system design.

Also, if you rely on hardware features for safety, it's still ok/good to design the software as if it didn't depend on those features whereever possible.

Re:Killed by a Machine: The Therac-25 by dsfyu404ed on Monday August 01, 2016 @10:50AM (#12202776)
It all depends on the specifics. How much complexity will software checks add? In a lot of cases the lifetime cost of spec'ing a hard failsafe may be cheaper than designing, implementing and supporting a soft one. Then there's the whole issue of software false positives/negatives vs hardware failures

At some level you can no longer abstract away the situation and the system has to perform as a system. You can write soft controls all you want but if hard controls are present in the spec and something that's not likely to change there becomes a point where chasing down every little problem and checking for every possible error is no longer cost effective. Nobody cares if you write Mars rover tier code for a bulldozer and spending the resources doing is wasteful if your competitors aren't also spending the resources. Obviously you can write total crap that's outside the acceptable range toward the other end.

If you're designing software to control a widget that moves and does stuff has a hard switch to prevent your widget's equivalent of an out of battery detonation you have to strike a balance between relying on it and introducing complexity from soft controls. Every aspect of the system is involved in making that determination.

If you've got a hard switch in most cases you may as well write a five line timeout controlled while loop that tries to perform the action and waits and tries again if there's no feedback indicating the action was performed. As long as nobody removes that switch and the code's dependency on it is very obviously documented then that simple unsafe code is probably better than more complex code that performs a redundant (redundant because you have a hard switch) check because the more complex code has more going on.

Re:Killed by a Machine: The Therac-25 by throwanem on Monday August 01, 2016 @03:58PM (#12205410)
I mean hey, if I'm writing code for a machine that might kill somebody if a hardware interlock is removed, I'm going to perform a software check for a valid state before I take the potentially fatal action, and if that's a problem for the organization that's paying me to write that code, I'm going to resign and find work elsewhere, because that outcome strikes me as strictly preferable to having someone's death on my conscience. I suppose it's arguable either way, though.