Embedded systems of critical importance

Is software running medical appliances written in a sane, sensible fashion these days Zig Forums?
I'd expect it to but seeing the previously high standards of embedded systems among western militaries crash with no survivors in recent years makes me worried.

Attached: You_broke_my_computer.png (1500x1500 679.87 KB, 84.59K)

Other urls found in this thread:

github.com/propublica/nyc-dna-software
khronos.org/openglsc/
misra.org.uk/Activities/MISRAC/tabid/160/Default.aspx
blackberry.qnx.com/en/products/neutrino-rtos/index
en.wikipedia.org/wiki/Zilog_eZ80
en.wikipedia.org/wiki/Transistor_count#Microprocessors
twitter.com/AnonBabble

...

Depends on the kind of device. I'm not in the industry, but my guess is that medical software is pretty good based on the fact that the industry is pretty highly regulated.

Overall, I'd say that aerospace and nuclear have the highest software quality, with medical somewhat after those two, and all three much better than "Enterprise" software.

It's not written in Rust, so it's a huge pile of insecure pajeet shit.

Wasn't there some medical equipment written in complete pajeet code? I remember a thread about something like that a while back.

Pick one.

I used to work in the medical field, and I'll say that most of the devices that keep you alive and report you being alive tend to be pretty simple machines, compared to an F-Whatever,
and has it right with being highly regulated, with equipment failures of almost any kind set off all kinds of bells and whistles (even if it happens more than it should)


I'd like to see that thread, user
I'm wondering if thats why the newer equipment seems to just...not function as well as some of the older shit

What makes medical software better than "regular software" ? Responsibility. All the people involved are putting their names, reputations and financial stability on the line. If some engineer fucks up the computerized tomography control program and it gives patients radiation overdosages, you bet your ass someone is going to pay dearly for that.

This just doesn't happen in other fields. Remember that bank or whatever that exposed people's personal information when it got cracked? What happened to it? Probably nothing. Companies ship objectively insecure hardware and software every day and they aren't held liable for defects and security breaches. Open source software openly disclaims any warranty -- nobody is going to be responsible for anything here.

I have worked in the field and in aerospace companies.

As the other user said most of the really critical stuff is extremelly simple, little more than a loop. I have worked with RTOS before but usually they are not needed or willed for the extreme critical stuff.

I believe the lowering in quality in military systems is related to code obsolescense, the introduction of (more) code monkeys, ditching old programming languages (Ada or SPARK) and replacing them with C or C++ believing that static analysis will save you, so you can find said code monkeys more easily.

I remember diving in an almost literal pool of shit code (Ada) to fix some stuff only to discover at the end an absolutelly beautiful piece of craftmanship developed by the original engineer 25 years ago, seems that after that the company kept hiring cheap young consultants that didnt fully understand the code or Ada and just kept adding shit on top of the origonal baseline to adapt it to the new requirements, truly a pity. I tried to contat the original guy (out of admiration) but he was already retired and didnt find his contact info.

That said there are really nice advances latelly in formally verified code, I hope some day they do the jump into the industry and dont stay something purelly academical.

Ada programmers are too expensive nowadays, and Ada isn't good friends with 'secure IoT', so no. The future is the past, with C++. Welcome to the perpetual 1990s.

Regulation is just a profit center. Regulation save any banking crashes, stop Bernie Madoff, enron, prevent any oil spills, prevent hotdog vendors from selling dogmeat in NYC, or fix the power grid?

Anything more important than the shit code running our grid with zero protection?

The thing about aerospace and nuclear is they got something that works, and it wasn't broken, so they never "fixed" it. This is why lots of nuclear control systems all still use shit like motorola 68000's. It's a bit like cars, where you're 20 years behind the curve when it comes to "new tech", but the tech that made the grade went through 20 years of fucking testing and analysis and certification. Will it seamlessly bluetooth tether to your iPhone without forcing you to fuck around for 15 god damn minutes? No. Will it work, and continue to work without interruptions or issues for the next 25 years? Yes.

Attached: sogei.jpeg (512x512, 28.57K)

This seems like the real answer to me. Nothing strikes terror into the hearts of codemonkeys (or the managers that push irresponsible demands on them) like the threat of lawsuits that can run into the multiple millions of dollars.


The general analogy is valid, but your specific point about media support in cars is kind of a silly example, since the one part wholly responsible for that (the head unit, which slots into DIN bays that have been standardized since the 1970s) is a standalone accessory that has little or no connection to any crucial system of the vehicle, and for which there is absolutely no excuse not to have a completely modern one sourced for any new car or installed by any dealer.

Attached: gavel-judge-court-OHIO-millv1.jpg (1368x1026, 84.71K)

i know an old defib that used to say on the creators birthday "happy birthday"

Precisely, you can't ship the beta, and patch it later.
Same with any robotics programming, like CNC G-Code, bad code has immediate, tangible, and costly results.

Most of these are running small microcontrollers and DSPs. In all honesty, though, the code quality is often very bad. Despite the regulations (or maybe because of them) there's very little incentive to do anything other than a big bucket of spaghetti.
They do get tested very extensively, though, and the engineering design reviews are over the top. So, as long as there is no connection to the outside world, they'll be solid as a rock.
Now, security-wise? Medical devices are almost all a disaster. Few people in the industry are security experts, although this is changing slowly.
The actual problem is that working under FDA/etc guidelines is a pain in the ass. Most antisocial programming savants can't cope with the bullshit. So, most of the engineers are either old and overpaid, or total incompetents who can recite buzzwords. The resulting products are either late and over budget, or cheap and ticking time-bombs.

I remember that someone, who held a presentation about remotely manipulating ATMs to dispense money (it's on youtube, you should find it pretty quick), died due to drug overdosing. The next presentation supposed to hold in the future was about remotely accessing pacemakers or insulinpumps or something - so something potentially really dangerous. And damaging to the companies involved. I can't remember exactly.
This was not that long ago, I think. But I feel pretty old now, so who knows. I can't search Youtube right now, so I'll have to leave that to you.
Judging from the fact that these things were really produced, I'd say that there's probably some company right now selling dangerous medical appliances. I don't know what languages these things were written in, but as long as it's remotely accessible, it's potentially dangerous. And every salesman loves to sell convenience.

Attached: 47564865186.jpg (1920x1080, 108.1K)

You mean in node.js with REST microservices?

DNA testing software made by poos made false positive tests.
github.com/propublica/nyc-dna-software

It just work, they work correctly I'd trust old hardware but nothing to shinny and new. I mean that on a software/internet level of course otherwise it just works.
The medical world outside of experimental shit is a hellhole of DRM and only running with MS windows, some of them are still on XP but these old ones don't require a MANDATORY internet connection.


All the new equipment works as good as the new ones the only difference is the datamining that's spreading on the brand new equipment (even pacemakers) and that products who aren't life threatening (pacemakers for example) are made to artificially broke/have error down.

I'm actually working on a patient monitor nowadays. I literally work alone, nobody but me ever looks at the code. Our standards guy has said that risks need to be evaluated, but my boss is too close to retirement to care.

That being said, I do care, and I AM a little apprehensive of causing major harm / death in the future.
Anyway, more expensive products, and ones from big multinationals are sure to be validated and documented out the ass, but that in itself isn't a guarantee either.

Attached: 1358658941133.jpg (595x652, 259.96K)

who woulda thunk

I think someone demonstrated that one a few years back, they never patched it any capacity AFAIK.
It's one of the reasons I'm still using syringes.

Attached: Farenheit451.jpg (1120x630, 156.27K)

My entire family is in the medical business\


Wanna make some've dat muneh? Make a replacement for that EPIC PIECE OF SHIT

I'm a medical student and have been a programmer for a long time. Patient monitoring equipment ranges from purely analog machines to digital and integrated monitors; I've never had reason to doubt the reliability of the newer machines. They're like black boxes, designed to perfom an exact well-defined function; as long as testing shows that the results are compatible with expectations, there is no reason to even think about how crappy the code is. Generally, this type of equipment are isolated from other computers and their only interface consists of sensors attached to patients. You'd need physical access to abuse these machines. Obviously, computers hooked up to a network should be held to an even higher standard, wireless hardware doubly so. My city's hospital showed surprising savviness when it prohibited all external USB devices from being connected to their computers, opting instead to provide people with their own hardware for internal use only. This was before the ransomware attacks in England hospitals.

The electronic medical records software ranges from extremely bad to OK if a bit convoluted. I've shadowed doctors that used ridiculously bad systems in their private practices; systems whose idea of access control consisted of modal dialogs and whose notion of backup consisted of copying the mysql directory to another directory on the same machine. Huge private hospitals have much better software; IIRC my city's uses a Tasy from Philips and from what I've seen it works pretty nicely. Doctors apparently use smart cards to authenticate. The software is still plagued by little error messages nobody reads (seem to be related to cryptography, as if doctors cared about that) and general unusability; doctors have a very task-oriented approach to using it, a new guy often goes to a experienced doctor and asks questions such as "how do I intern a patient?" or "how do I order tests?" and once they learn how to do stuff it becomes a mechanical task to them, "just something they gotta do" to enter the patient into the system, nobody really spends time truly understanding the program and its flow like an Emacs user.

I want to code my own medical records system someday, focused on private practice where choices seem to be universally horrible. I want to make a system I'd like to use. Another ambition of mine is to become an auditor; my country has standards for electronic health records systems and I would like to enforce them. I'd especially enjoy hammering the retarded software I mentioned above; their "oh just whip up some garbage implementation so we can say we met the requirements" approach to backups and security shouldn't be acceptable.

Cool your autism, that was a "stuff" shit not a "shit" shit.

I'm still using syringes because I fucking actually hate the pump. Tried it, felt even more inconvenient having shit stuck to me at all times. Stopped using it. "More convenient" my ass. Especially since the supplies are much harder to get. I can get syringes at the Walmart pharmacy for like 5 bucks without insurance

Graphics for these programs is implemented using API's like OpenGL SC (Safety Critical): khronos.org/openglsc/

If it goes into a car, airplane, or medical appliance, it is probably using OpenGL SC.

C programs would be written according to MISRA C gudelines here:
misra.org.uk/Activities/MISRAC/tabid/160/Default.aspx

The operating system would not necessarily be Linux- it is probably on a more reliable system like QNX:
blackberry.qnx.com/en/products/neutrino-rtos/index

Which is certified for safety-critical uses like in cars, medicine, etc. This is the kind of OS that safe software uses.

It's like you want to stick needles up your ass

is curing diabetes even possible
i thought it was like cancer "you get it you have it for the rest of your life" type shit

IF you improve your life habits you can make the symptoms go away, i.e. the damage it could do to the eyes and extremities etc. it would come back if you started consuming sugar and not excercising. Type 1 diabetes aka congenital diabetes can't be cured though, unlike type 2, which can be tamed like aforementioned.

all sorts of fail safes built into these

Depends.
Type 1 diabeetus is likely impossibru as even if you managed to somehow clone and reattach langerhans islet cells inside the pankreas they'll get wiped out by the immune system before long.
CRISPR/Cas might open the way for mass gene editing which could even allow one to alter the patterns stored in memory T lymphocytes through pill ingestion, but at that point man may as well resign himself to his fate as a biological botnet.
Type 2 is "curable" through avoiding saccharides like the plague as it is caused by an overabundance of sugar inside cells, leading them to shut down their saccharide carrier proteins to avoid overheating from taking in and digesting too much sugar.

Type 2 diabetes = an overworked pancreas = curable with lifestyle changes and is typically caused by poor diet and lack of exercise (although there are always rare exceptions to this)

Type 1 diabetes = autoimmune disorder = currently incurable. It's caused by the bodies immune system actively attacking beta cells in the pancreas and people are typically born with it if not get it early in life. You can't just add more beta cells because the body will just attack those too. You can't compromise the bodies immune system to not attack beta cells because that's the antithesis of a cure and doctors aren't keen on giving patients virtual AIDS. Another problem is most funding to "cure" the disease is being funneled to big Pharma to come up with "treatments" instead of an actual cure (aka "BUY MORE EXPENSIVE SUPPLIES OR YOU DIE GOY!")

Attached: 1514010646201.jpg (800x1200, 143.7K)

It is not unlikely for such a scenario to happen on a wider scale.

Attached: 800px-GRNA-Cas9.png (800x536, 76.8K)

No, most of it runs on Windows XP. It varies by countries and regions but most medical computers aren't really secured beyond whatever's enforced on the local network. They depend heavily on blacklisting known bad sites and securing other networking hardware like routers because it's cheaper than upgrading every Windows PC in a hospital. You should also keep in mind that most of their stuff runs on standard Intel hardware in the form of cheap office PCs or embedded industrial boards. These things are usually a decade old at least and don't get proper microcode updates and BIOS patches. Windows XP and 2000 obviously don't get patches so this leaves them vulnerable to stuff like Meltdown and Spectre.


The software situation is a lot better for those things. In cars, planes (civilian and military), tanks, rockets, and nuclear power plants, they often run a microkernel RTOS such as QNX or INTEGRITY-178B. These systems have self-healing properties due to their modularity, they never have to go offline even for kernel updates, and device drivers can be run in outside of kernel space for additional security.

But hardware is a different story. The US DoD in particular has had problems in sourcing components for weapons systems, especially for the embedded computer systems inside them. Often times they'll end up with cheap chinkshit parts that are 10-20 years old that have been sanded down and repackaged as new. These parts might pass initial quality control testing but will fail at unknown times in the future within the service life of these pieces of equipment. They're ticking timebombs that could bring entire weapons systems down. This could lead to soldiers and civilians dying if weapons misfire or don't fire at all.

Technology is far from perfect and most things we'd consider super advanced are really held together by duct tape and hanging by a few strands of yarn.

can someone tell me if 6502 is still being used today and if yes what for ?

Everything you can think of, from keyboards to ovens. It and its rival from the other big ISA family, the z80, are probably the two most widely produced microcontrollers in the world today.

I honestly cannot tell if you're kidding or you're serious. Aren't 6052 and Z80 really old architectures? Are chips for them even made anymore when we have newer ones like AVR, PIC, and ARM?
It just seems weird for them to be still in use today, i don't see them out of hobbyist projects

Damn, I miss BB10.

Unlike consumers, industries need real reasons to abandon things

They have newer versions of Z80 with some improvements (and also clocked higher). Actually even in 1995 you could get a 16 MHz Z80, which was in fact used as the CPU in the Amstrad PCW16. But now they make them much faster still.
en.wikipedia.org/wiki/Zilog_eZ80

Attached: alice-amstrad.jpg (556x741, 88.39K)

Totally serious, remember just how tiny those old CPUs were:
en.wikipedia.org/wiki/Transistor_count#Microprocessors
Notice the ancient 8-bit chips were barely a few thousand transistors, whereas even the simplest modern CPUs are tens or hundreds of times that. Quite often, all that's needed is just any CPU power at all, the less of your transistor budget needed the better.

Also, keep in mind most embedded CPUs aren't even on their own dice, but exist only as a tiny SIP core sandwiched between external interfaces, caches, and offload ASICs, elsewhere on the floorplan fabbed at modern feature sizes on modern processes.