Safety-Critical & High-Consequence Design

Overview

Embedded systems are everywhere, from implantable medical devices to self-driving cars. As more embedded systems connect to the internet and to each other, the potential for human injury also increases as these systems become vulnerable not only to malfunction, but also to hacking and other malicious attacks.

This course explains several key design techniques that can be used to develop safer, more reliable embedded systems. Through our consulting work with companies across a wide range of industries, we are continually surprised by how many of these techniques—including those taught in this course—are not more widely known and practiced.

Attendees will learn the “what, why, and how” of approximately a dozen practical, lightweight techniques for designing safer and more reliable embedded systems. The focus is on minimizing hazards and malfunctions through approaches that are both lightweight and demonstrably effective. Architectural, process, and cultural considerations are also covered.

Who This Course Is For

This course is suitable for embedded engineers who are comfortable writing C or C++ code. Students typically have roles such as firmware engineer, systems engineer, and test engineer.

Students require no prior experience with real-time operating systems. Even experienced engineers will learn important topics that can be applied to building robust, deterministic embedded systems with timing and power constraints.

Course Curriculum

Detailed course curriculum can be provided upon request.

System Partitioning for Designing Safe, Robust Systems

We'll discuss hardware/software partitioning of functionality and how to best allocate responsibilities in order to minimize the “blast radius” of a fault.

Run-Time Monitoring

We'll cover power-on and runtime self-tests, along with techniques for monitoring CPU load and detecting and mitigating memory corruption.

Design for Test

Here we discuss software design techniques that improve controllability and observability in an embedded system, both of which are essential for test.

Managing Time for Safe Product Operation

How do you ensure that your embedded system meets all its timing requirements under all conditions? Real-time deadlines are serious business in high-consequence systems.

Run-Time Logging

Everything from logging strategies to accurate timestamping and runtime configurability. Also, how can the data be exported securely so that it can be trusted?

Safety Case

A safety case provides a structured argument, supported by evidence, that demonstrates the designers have anticipated and mitigated failures such that if the product malfunctions, it will "fail safely."

Managing Software Complexity

As complexity increases, maintainability, robustness, and testability suffer. Here we cover techniques for measuring, reducing and controlling software complexity.

Coding Standards

A quality-focused coding standard can reduce safety-compromising bugs. We discuss choosing, modifying, adopting, and enforcing a coding standard whose rules are not about style, but about keeping bugs out of your code.

Static Analysis

Static analysis tools are indefatigable allies, vigilant in keeping latent defects out of your code. But to use such a tool, you must choose one, configure it, use it correctly and consistently, and understand its output before addressing any flagged issues.

Code Inspections

For decades, engineers working on space programs, weapons systems and medical devices have recognized that code inspections, while time-consuming and labor-intensive, still yield the best “return on investment” for the most critical parts of your code. Learn how to conduct them properly and effectively.

Issue Tracking

All systems have bugs. Some go undetected for years. Some are more critical than others. How do you track and fix bugs in your product? Is your approach systematic or ad hoc? Do the same bugs keep reappearing? Are certain parts of your code “bug farms”?

Post Mortems

Failures happen. But every failure is an opportunity to learn and improve. The practice of post-mortems is widely used in the medical community as well as the aerospace and transportation industries. What are the key principles of post mortems and how should they be conducted?

Our Instructors

Our courses are taught by experts who have written real-time kernels, designed mission-critical systems, testified in U.S. federal court, and reverse-engineered proprietary kernels from object code. Throughout each course, topics are connected to real life examples pulled directly from the instructors' experience.

Our instructors have taught teams at every major silicon vendor, more than a dozen medical device companies, and numerous firms working in defense / aerospace, transportation, industrial control, instrumentation, robotics and energy.