Re: Validation in non-regulated industries/markets

Nov 08, 2024 Last reply: 1 year ago 3 Replies


In *regulated* industries (FDA, aviation, etc.), products are


> validate (hardware and software) in their "as sold" configurations.
> This adds constraints to what can be tested, and how.  E.g.,
> invariants in code need to remain in the production configuration
> if relied upon during validation.
>
> But, *testing* (as distinct from validation) is usually more
> thorough and benefits from test-specific changes to the
> hardware and software.  These to allow for fault injection
> and observation.
>
> In *unregulated* industries (common in the US but not so abroad),
> how much of a stickler is the validation process for this level > of "purity"?
>
> E.g., I have "test" hardware that I use to exercise the algorithms
> in my code to verify they operate as intended and detect the
> faults against which they are designed to protect.  So, I can inject
> EDAC errors in my memory interface, SEUs, multiple row/column
> faults, read/write disturb errors, pin/pad driver faults, etc.
>
> These are useful (essential?) to proving the software can
> detect these faults -- without having to wait for a "naturally
> occurrence".  But, because they are verified/validated on non
> production hardware, they wouldn't "fly" in regulated
> markets.
>
> Do you "assume" your production hardware/software mimics
> the "test" configuration, just by a thought exercise
> governing the differences between the two situations?
>
> Without specialty devices (e.g., bond-outs), how can you
> address these issues, realistically?
>

I think perhaps this is confusing systems testing with product testing. You need to make a clear distinction between the two.


Systems testing is about checking that a /design/ is correct. Much of that is usually about software testing, but it applies to hardware too. This will often be done using modified hardware so that you can, for example, inject /realistic/ faults and check that the hardware and software function as expected. Depending on the application, you might also run test boards at high temperatures or otherwise abuse them to confirm the design.


Production testing is about ensuring that the products made are correct according to the design. You don't check that the memory works, or the ECC handler works - you check that you have correctly mounted and soldered the memory chip and that the memory chip supplier has checked for production faults.


There are some products where the likelihood of developing partial faults in the field are high and the consequences of that are serious but it is useful to be able to keep a partially failed system in action. There are also products with user-serviceable parts. Then it is often helpful to have some kind of self-test to identify failing subsystems.


Unfortunately, in some regulated markets, or for some types of "safety certification", the rule-makers don't understand how this works. The result is that they insist on extra fault-checking hardware and/or software that actually decreases the total reliability of the system, and introduces new parts that in themselves cannot be checked (systematically, in production, and/or in the field).


How do you deal with it? You follow the rules, even though some of them were written by muppets.

On 8th November 2024, David Brown wrote: "Unfortunately, in some regulated markets, or for some types of "safety certification", the rule-makers don't understand how this works. The result is that they insist on extra fault-checking hardware and/or software that actually decreases the total reliability of the system, and introduces new parts that in themselves cannot be checked (systematically, in production, and/or in the field)."

Professor William H. Sanders from the University of Illinois at Urbana-Champaign dishonestly boasted in a lecture to us on what he pretends to be "Validating computer system and network trustworthiness" that he has solved a problem to guarantee successes against faults and that NASA had complained that this problem is not solvable. He showed us this sham supposed solution. So I immediately accused him that this proposal does not succeed. So he admitted this accusation when he said "Who checks the checker?" Many papers exist with a similar title to this question. They are supposedly named after a supposedly common question about Ancient Roman soldiers.

Regards.

By "validation", I would normally think that the /customer/ is accepting the product as working well enough for their needs. This is roughly what you wrote, but the emphasis is on who does the validation.

Nope.

Testing only ever shows the presence of bugs - it can never show their absence. Only in very limited circumstances can you use testing to show that something meets its specifications - basically, you need to be able to test the system for every possible valid input (i.e., every input that is within the usage specifications). That is sometimes possible for small software functions, but very rarely feasible for larger functions or anything involving hardware.

And even then, you are not "ensuring" it meets the specifications - you are "demonstrating" it. The way you "ensure" you meet the specifications is my having a rigorous enough development procedure (which will include testing of many types) that you can be highly confident of correct behaviour. Testing is vital to this, but it is not remotely sufficient.

Absolutely true. That's part of what makes development fun!

Like I said - you do fault injection and similar testing as a systematic test of the design and fully replicable parts of the system (like software). You don't do it on final products.

And customers may be involved in, or have insight into, such fault injection tests.

You talk about "proving" the device meets the customer's needs, and "ensuring" it works according to specification. That's just wrong. This is not a pass/fail binary thing where you have proof of correctness

- its a matter of risk reduction, failure mitigation, and confidence. You are never trying to make something that is "perfect" in the true sense - because you can never succeed. What you are trying to do is get a high confidence that there is a low risk of the product not fulfilling its specifications, and that the ill-effects of any failings are minimal within the time and cost budgets.

You achieve this by combining many methods, each of which reduces the risks. That starts with good specification methods, passes through design and development phases, test phases (including fault injection and other systematic tests), production tests, long-term tests, artificial ageing tests, follow-up testing of deployed devices, and whatever else suits for the type of project and budget.

That's not validation. Validation /does/ exist for a reason - it's what lets the developer get paid and not sued even if the customer later on thinks of an extra clause that they should have had in their specifications. "Validation" is the point when the customer takes on the risks for the product not actually working according to their needs (which they might not be fully aware of).

<snip>

OK boss says i gotta build a self driving car huh... ok lets see... java, that's a given.. alright... *starts typing* public class Car extends Vehicle {...

Join the Discussion

Have something to add? Share your thoughts — no account required.

Didn't find your answer?

Ask the community — no account required