Few questions on embedded stuff - Page 2

Do you have a question? Post it now! No Registration Necessary

Translate This Thread From English to

Threaded View
Re: Few questions on embedded stuff...

Quoted text here. Click to load it

You could try jumping out of an airplane with and without a parachute
and see which way you like it better....

Take a couple of lawyers with you.


Re: Few questions on embedded stuff...

Quoted text here. Click to load it

Excellent example: for a sky diver the WDT is an altimeter!!!
(Really and Truly) - RM


Re: Few questions on embedded stuff...

Quoted text here. Click to load it

Why don't blind people like to go skydiving?

(Answer is in tnext post. please try to guess the answer first...)



Re: Few questions on embedded stuff...
Guy Macon <http://www.guymacon.com says...

Quoted text here. Click to load it

.

.

.

.

.

It scares the dog.


Re: Few questions on embedded stuff...
Hi Rick,

Quoted text here. Click to load it

Actually, yes. There are altimeter-equipped automatic opening devices in
case someone panics, faints or whatever. They asked us on our first
non-ripcord jump whether we wanted one. But they have downsides as well
and can open inadvertently before you are in a good position to pull. I
opted to go "without" but carried my wrist altimeter (which was legally
required).

Regards, Joerg

http://www.analogconsultants.com

Re: Few questions on embedded stuff...
On Sun, 27 Jun 2004 21:21:18 GMT, Joerg

Quoted text here. Click to load it
the use of Ps to cover up inadequate aircraft design is not.
Quoted text here. Click to load it

   Huh? You jumped out of a perfectly good, operating airplane??? Or
was it the airplane described at the end of Ganssle's WDT article?

Quoted text here. Click to load it


Re: Few questions on embedded stuff...
Hi Ben,

Quoted text here. Click to load it
That's exactly what a Boeing engineer once said to me. He thought it was
insane to jump out of a fully serviceable airplane. But it isn't insane.
We tried to convince our pilot and many of the glider folks to do at
least 2-3 jumps so they know how it feels if they ever have to. Most of
the glider folks declined and then one day the story was in the news.
One had a structural failure a few thousand feet up, high enough to
jump. He hesitated too long to bail out and didn't make it.

Regards, Joerg

http://www.analogconsultants.com

Re: Few questions on embedded stuff...


Quoted text here. Click to load it

The real insanity is those people who jump out of an aircraft that
isn't on fire into a forest that is...



Re: Few questions on embedded stuff...
Quoted text here. Click to load it
serviceable airplane.

... or to get into one that isn't. I heard tell a few years back that
the Boeing engineers who service the Chinese inland airliners travel
by train:-).

Clifford.

Re: Few questions on embedded stuff
Hi Paul,

Quoted text here. Click to load it
Yes. I guess Guy was pretty much to the point here and I assume his
thoughts are similar to mine: A WDT is a good line of last defense but
relying on it to "clean up messes" is not good. If it ever had to come
on this event should be logged and somebody should then get to work and
find out why it came on. It's the same with airbags. If one ever was
activated that usually means a crash has occurred and we can be pretty
certain that the police will want to find out why that happened.

Regards, Joerg

http://www.analogconsultants.com

Re: Few questions on embedded stuff
...A WDT is a good line of last defense but
Quoted text here. Click to load it

Right. But a complex system with lots of resource locks can get into
unanticipated states, and one of those might require an automatic
reboot - by the WDT. - RM


Re: Few questions on embedded stuff

Quoted text here. Click to load it

That's the answer, that horrifies me.

Andreas
--
It's not the things you don't know what gets you into trouble. It's
the things you do know that just ain't so.
We've slightly trimmed the long signature. Click to see the full one.
Re: Few questions on embedded stuff

Quoted text here. Click to load it

Suppose you have 5 processes and 5 resources used (let's say)
by each process: how many permutations would that be, and can you
think of a way to check out all those timing possibilities?  -  RM


Re: Few questions on embedded stuff
On Mon, 28 Jun 2004 00:36:59 GMT, Rick Merrill

Quoted text here. Click to load it

If you let each process lock multiple resources at a time and
different processes do this in a random order, you sooner or later end
up in a deadlock situation. Using a WDT to cover this up is IMHO a
design flaw.

You can often get a much cleaner design e.g. by allocating a separate
"owner" process for each resource (e.g. for each hardware device) and
do all the hardware access (or at least do the arbitration) in this
owner process. There are far less permutations that needs to be tested
and as such, might even be tested :-) before releasing the product.

Paul


Re: Few questions on embedded stuff

Quoted text here. Click to load it

I certainly agree. Ideally each interrupt driven thread should raise
  its priority level to the top when it uses a resource. Here is an
actual (expurgated, paraphrased) case:
CodeReviewer: "Say, this low priority task does not turn off
interrupts when using resource#5."
Programmer: "EVERYBODY KNOWS that high priority tasks NEVER use
resoruce#5."
--several releases later: system crashes: cause: deadlock.
analysis: another programmer left a debugging statement in a high
priority task and that statement called for use of resource#5 (a
communication buffer).  -- and so a WDT was installed!

Yes, you are quite right, but it is hard to enforce correctness on
large, old systems. - RM


Re: Few questions on embedded stuff
...
Quoted text here. Click to load it

I just remembered another case I heard about where a WDT helped
CAUSE a problem!:  An intermittent hang in the acct. pac. caused the
WDT to fire and shut down the system; when the system came up it
would notify the other nodes in the system that it was Here (oh
joy)!  This notification would cause the other nodes to send a
message to their acct. pac. and it (being intermittent) would
occasionally hang that other node and the process spread throughout
the system!!! (all nodes ran the same s/w release!)-- RM


Re: Few questions on embedded stuff

Quoted text here. Click to load it

Just request them in the same order in all processes. In the flow of
logic of any process do
lock 1
free 1
lock 2
free 2
lock 3
free 3

or
lock 1
lock 2
free 2
lock 3
free 3
free 1

Never go 1-2-3 in one and 1-3-2 in another process. Nevertheless, you
can go 1-2-3-4 and 1-2-4 and 1-3-4 in different processes.

To make this possible is called design. You can even resort to one
super-resource, though your timing may suffer by this approach.

Andreas
--
Debugging is twice as hard as writing the code in the first place.
Therefore, if you write the code as cleverly as possible, you are, by
We've slightly trimmed the long signature. Click to see the full one.
Re: Few questions on embedded stuff
Hi Rick,

Quoted text here. Click to load it

Those complex systems require thorough documentation including resource
locks, extensive design reviews and most of all strict discipline. I
have seen very complicated systems that really never locked up but
others mainly in the consumer software area that lock up all the time.
One of the common problems whenever I was participating in SW reviews
used to be that people grabbed memory space but forgot to release it
back after their routines had completed. That is the stuff that leads to
freezes.

A good version control system helps a lot but it won't do it all.

Regards, Joerg

http://www.analogconsultants.com

Re: Few questions on embedded stuff
Quoted text here. Click to load it

Here's a scenario:  The device in question is thoroughly documented and
carefully designed.  All timings, memory, and other system resources
have been carefully constructed so as to assure that no locking
contention is possible.  It is working very nicely, and a particularly
energetic gamma particle flips just one single bit in RAM from a zero to
a one.  That single bit happens to be the return address from the
interrupt that is now running, and so instead of returning to address
0xfe320, it now attempts to return to 0xfe300, which is in the middle of
an instruction.

There are a number of possible valid approaches to countering this kind
of flaw, and one of them is the use of a WDT.  Bad things can happen
even in very well designed systems.

OTOH, poorly designed systems will probably have poor operating
characteristics whether or not a WDT is used.

Ed


Re: Few questions on embedded stuff
<snip>
Quoted text here. Click to load it

  This has some interesting info on the content-reliability of SRAM:

http://www.physorg.com/printnews.php?newsid22%7

.. Funny how the vendors are quiet on soft-errors, until they have
a structure that reduces it by some 4 digits....
-jg


Site Timeline