S
Stef
Guest
In comp.arch.embedded,
Joerg <invalid@invalid.invalid> wrote:
Why do you mention the FPGA? I think we are not talking about the same
thing here.
What I meant was adding some 'real' hardware to limit things that could
get dangerous and are under software control. It is very common to add
such protection to reduce the software risk class.
Example:
A device generates a train of current pulses that pass through a
patients body for some kind of measurement. The safety of these pulses
depends on the duration, frequency and current. All of these parameters
are under software control, so in theory the software can create a
dangerous situation. This puts the software in a high risk class.
If you add hardware that monitors the output signal (timers,
comparators) and that switches off the output when the signal goes out
off bounds, the software can no longer create a dangerous situation.
That reduces the risk class of that piece of software.
This practice of adding hardware to remove the safety risk from
software is very common.
<snip, a whole lot we mostly agree on>
That's where I don't agree. If I change something in my software that
is protected by hardware like in the above example. I can do my
internal tests and write a document for the notified body. This
ofcourse takes time and care but it is much less work than a full
re-certification effort. I don't need to repeat my safety tests, EMC
tests etc.
--
Stef (remove caps, dashes and .invalid from e-mail address to reply by mail)
Think lucky. If you fall in a pond, check your pockets for fish.
-- Darrell Royal
Joerg <invalid@invalid.invalid> wrote:
Stef wrote:
In comp.arch.embedded,
Joerg <invalid@invalid.invalid> wrote:
Stef wrote:
In comp.arch.embedded,
Joerg <invalid@invalid.invalid> wrote:
Nope. Not if it's in the worlds of medical or aerospace. There you have
a huge re-cert effort on your hands for changes. New layout? Back to the
end of the line.
That is not always true (at least for medical equipment, no experience
with aerospace). If the change is minor enough, it may be enough to
write a rationale that explains the change and how it does not impact
the function of the equipment. If the notified body agrees with the
rationale, only a limitied effort is required to re-cert.
I really doubt they would agree if a code re-compilation was required to
make this work. With code and firmware they have become very careful
because there have been to many mishaps.
That depends on the software risk class. If the software imposes no risk
(risk mitigated in hardware for example), I don't think they would care.
That is almost never the case. An FPGA, just like a DSP or uC, is too
close to the game to be able to make that kind of safety claim in most
cases.
Why do you mention the FPGA? I think we are not talking about the same
thing here.
What I meant was adding some 'real' hardware to limit things that could
get dangerous and are under software control. It is very common to add
such protection to reduce the software risk class.
Example:
A device generates a train of current pulses that pass through a
patients body for some kind of measurement. The safety of these pulses
depends on the duration, frequency and current. All of these parameters
are under software control, so in theory the software can create a
dangerous situation. This puts the software in a high risk class.
If you add hardware that monitors the output signal (timers,
comparators) and that switches off the output when the signal goes out
off bounds, the software can no longer create a dangerous situation.
That reduces the risk class of that piece of software.
This practice of adding hardware to remove the safety risk from
software is very common.
<snip, a whole lot we mostly agree on>
In my experience, in medical device you can sometimes do changes without
re-certification, but certainly not always. Thats why I started with "That
is not always true".
In the end the effort is mostly almost the same. In SW or firmware it's
regression testing et cetera. For safety boundary changes it's module
tests. And there it hardly makes a difference how much of it must be
re-tested.
That's where I don't agree. If I change something in my software that
is protected by hardware like in the above example. I can do my
internal tests and write a document for the notified body. This
ofcourse takes time and care but it is much less work than a full
re-certification effort. I don't need to repeat my safety tests, EMC
tests etc.
--
Stef (remove caps, dashes and .invalid from e-mail address to reply by mail)
Think lucky. If you fall in a pond, check your pockets for fish.
-- Darrell Royal