<div dir="ltr">
<p style="margin-bottom:0cm">Paul,</p><p style="margin-bottom:0cm">Thank you for a good
summary of the initiatives to approve the use of Linux in safety
applications.<br></p>
<p style="margin-bottom:0cm">You're missing the
Enabling Linux in Safety Applications (ELISA) project <a href="https://elisa.tech/" target="_blank">ELISA
- Advancing Linux in Safety-Critical Systems – ELISA</a> and EB
corbos Linux for Safety Applications <a href="https://www.elektrobit.com/products/ecu/eb-corbos/linux-for-safety-applications/" target="_blank">EB
corbos Linux for Safety Applications – Elektrobit</a>.<br></p>
<p style="margin-bottom:0cm">
</p>
<p style="margin-bottom:0cm">I agree with Andrew
Banks when he asks what do you mean by Linux?</p>
<p style="margin-bottom:0cm">What do you mean by
certification authorities? Do you mean aviation, rail, automotive,
nuclear, medical, process control? The regulatory regimes are very
different.<br></p>
<p style="margin-bottom:0cm">I don't understand why
it's so hard for Linux to just comply with standards such as RTCA
DO-178C/EUROCAE ED-12C? DO-178C Level D is just Software Engineering 101. Even Level C isn't that hard. Why wouldn't you want to achieve
statement coverage? I remember attending a talk by the CEO of Red Hat
Linux UK, who admitted that most of their developers are volunteers
and prefer to spend their time coding rather than writing tests. The
open-source repositories that I've inspected contain alarmingly few
tests.<br></p>
<p style="margin-bottom:0cm">Another approach is to
follow the COTS guidance in RTCA DO-278A/EUROCAE ED-109A. It was
specifically written to allow the use of COTS software such as
operating systems. I understand that EUROCONTROL and NATS have been
deploying CNS/ATM systems based on UNIX for many years. RTCA
SC-240/EUROCAE WG-117 is working on better guidance on the use of
COTS and Open-Source Software (OSS) in aviation.<br></p>
<p style="margin-bottom:0cm">IEC 61508 provides
three compliance routes:<br></p>
<ol><li><p style="margin-bottom:0cm">Route 1s:
compliant development. Why is it so hard for Linux to just
comply with IEC 61508? The requirements for SC1 or SC2 are not very
onerous.</p>
<p style="margin-bottom:0cm"></p>
</li><li><p style="margin-bottom:0cm">Route 2s: proven
in use. This is not considered practicable for complex software such
as operating systems. This was recognised by SIL2Linux.</p>
<p style="margin-bottom:0cm"></p>
</li><li><p style="margin-bottom:0cm">Route 3s
assessment of non-compliant development. This is a very sensible way
of allowing the use of an open-source operating system such as Linux (more so
than the COTS guidance in DO-278A). Route 3s can be summarised as a.
what do we know about the software? b. what evidence do we have that
it works? and c. what happens if it goes wrong? This was the
approach adopted by SIL2Linux. Yet they failed. I'd like to
understand why.</p>
</li></ol>
<p style="margin-bottom:0cm">Your post is insulting
to certification authorities and those of us who participate in
standards committees. You imply that the certification authorities
are being unreasonable and that they should just allow people to
use Linux. I don't agree with your conclusion. If Linux is as
complicated as you say, they need to do more verification, not less.
I don't see how you can use statistical techniques to measure
confidence in software as complex as an operating system. I'm
reminded of the quote from Tony Hoare, "There are two ways of
constructing a software design: One way is to make it so simple that
there are obviously no deficiencies, and the other way is to make it
so complicated that there are no obvious deficiencies. The first
method is far more difficult". I'm also reminded of the quote
from the NTSB report on one of the Tesla accidents, "Just
because you can doesn't mean you should".</p><p style="margin-bottom:0cm"><a name="m_2889979891005487649_SignatureSanitizer_m_-5798674576462993830_SignatureSanitizer_SafeHtmlFilter_UNIQUE_ID_SafeHtmlFilter__MailAutoSig"><span style="font-size:10pt;font-family:Arial,sans-serif">Yours,</span></a><br></p><div><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div style="color:rgb(34,34,34)"><div dir="ltr"><div dir="ltr"><p><span style="font-family:Arial,sans-serif;font-size:10pt">Dewi Daniels | Director | Software Safety Limited</span><br></p><p><span lang="FR" style="font-size:10pt;font-family:Arial,sans-serif">Telephone +44 7968 837742 | Email <a href="mailto:dewi.daniels@software-safety.com" target="_blank">dewi.daniels@software-safety.com</a></span></p><p><font face="Arial, sans-serif">Software Safety Limited is a company registered in England and Wales. Company number: </font><font face="Arial, sans-serif">9390590</font><font face="Arial, sans-serif">. Registered office: Fairfield, 30F Bratton Road, West Ashton, Trowbridge</font><span style="font-family:Arial,sans-serif">, United Kingdom </span><span style="font-family:Arial,sans-serif">BA14 6AZ</span></p></div></div></div></div></div></div><br></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Mon, 5 Aug 2024 at 13:23, Paul Sherwood <<a href="mailto:paul.sherwood@codethink.co.uk" target="_blank">paul.sherwood@codethink.co.uk</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Hi Andrew<br>
On 2024-08-05 13:07, <a href="mailto:andrew@andrewbanks.com" target="_blank">andrew@andrewbanks.com</a> wrote:<br>
> I'd start with an easier question... what do you mean by Linux<br>
> <br>
> It's a Kernel, plus a whole array of other features; but what would the <br>
> Software BoM for Linux actually show? What is part of Linux, and what <br>
> are add-ons or apps?<br>
<br>
It's a fair question. I was using Linux as shorthand, but in practice <br>
the BoM needs to show not just the kernel, but also the boot loader, <br>
drivers, modules and applications. Moreover the compiler, linker and all <br>
component libraries can affect the outcome. And if the build environment <br>
is not sufficiently well controlled, results might also be tainted by <br>
things on the servers, or on the developers' laptops!<br>
<br>
br<br>
Paul<br>
_______________________________________________<br>
The System Safety Mailing List<br>
<a href="mailto:systemsafety@TechFak.Uni-Bielefeld.DE" target="_blank">systemsafety@TechFak.Uni-Bielefeld.DE</a><br>
Manage your subscription: <a href="https://lists.techfak.uni-bielefeld.de/mailman/listinfo/systemsafety" rel="noreferrer" target="_blank">https://lists.techfak.uni-bielefeld.de/mailman/listinfo/systemsafety</a><br>
</blockquote></div>