Korolyuk, E. S.

Electronic archive of Tomsk Polytechnic University

253 ANALYZING EMBEDDED DEVICE PROGRAMMING SPECIFICATIONS  IN CRITICAL SYSTEMS TO DESIGN PROGRAMMING GUIDELINES  E.S. Korolyuk  esk13@tpu.ru Scientific Supervisor: Ph.D. Brazovsky K.S.; Language supervisor: Vasilii Morozov, Sr. Lecturer. Dept. of Foreign Languages of the IC, TPU Software safety is an important characteristic, which indicates the probability of correct program operation under different operating conditions. However, embedded software developers do not always focus on this aspect, especially in critical systems. The present article discusses the international software security standards and certificates. The author studies the source code of the presently discontinued electrosurgical device EHVCh-80 by NPO «NIKOR» and analyzes the issues of validity of choosing the programming language and architecture. The paper provides the algorithm of the program’s operation and describes the main tasks performed by the microcontroller. In conclusion, the author uses the results of this software’s analysis to offer recommendations to simplify software support and possible options to reduce errors, both in the code and in the architecture of the developed application. The results of this research allow to increase software safety, especially in critical systems. With improvement of control systems in embedded designs, especially in systems that are critical to safety, it is necessary to ensure the safety and reliability of the designed software. Designers should understand that not only hardware failure (electrical, mechanical, etc.) in a medical device can cause the danger to the patient. Software bugs can also cause serious problems. There is a number of international standards and security certificates, for example MISRA C [1] or Safety Integrity Level [2]. When using these standards, the safety analysis lies in reducing a potential source of harm and decreasing it to the minimum. It is necessary to consider all steps of device development, from inception to decommissioning. SIL (Safety Integrity Level) certification addresses system level reliability.  Major accidents such as the Bhopal disaster (1984), the Piper Alpha oil rig disaster in the North Sea (1988) and others, have led to the creation of this certification. During the investigation of these events, demands were made by government agencies to check the systems responsible for safety. This led to the development of the international standards ISA S84 [3] and IEC 61508/61511[4] that in turn formed the basis of Russian standards such as GOST R IEC 61508-1-2007 [5]. The value of the level of reliability depends on whether the system will be subjected to more or less stringent requirements. The MISRA standard is a set of requirements (rules) for software development in the C language in addition to the standard rules. Both higher-order language and assembler language have their advantages in writing programs for microcontrollers. The main advantage of assembler is fast performance and small code size. On the other hand, there are disadvantages of poor readability and difficulties in maintenance. This adds additional constraints if it is necessary to add new features or change the structure of the program. If used incorrectly, a command to the microcontroller can change data and cause undesired operation of a device. Rigid attachment of a language to a specific platform makes it impossible to perform automatic analysis of code for security. The reasons for the C language’s popularity in embedded systems are simple. The language is standardized, and its constructs are easily associated with machine instructions. The code becomes independent of the microcontroller and it is possible to transfer the program to different platforms. In addition to syntax errors, there are other problems where the ISO C standard [6] specifies that the implementation may be certain or uncertain. Beginners face difficulties applying this programming language. The solution is to limit the use of some of the language’s functions with well-defined opportunities to enhance application performance. To solve these problems, the Motor Industry Software Reliability Association (MISRA) has produced a range of mandatory, required and recommended programming practices [1]. Medicaadditionmust alAs a relife cycprofit fnecessimicropadditionrequirediscontATmeglanguagrupt. vice is tings daments oThe prol industry pal monitorinso comply wi Research  Design an Mass prod Shipping  Operation Repairs  Disposal sult, due to ale. The main or further dety. Even withrocessor) becal techniquements that neinued electrosa8 microconte in the AVR ADC read Power out When the   When thenot in use, its  Timer 2 ista.  External in General pf the power pgram works aroduces prodg throughoutth safety regud developmenuction  dditional requreason is not velopment. In due reservesomes outdates and unconved to be puurgical devicroller [7] is th Studio enviros parameters put is regulattimer 0 overf timer 1 overpower section used for serterrupts are turpose pins aart of the devccording to tucts that dir the product lations. Produt irements for only the durattroduction o, during the dd and by the entional progt forward at e EHVCh-80 e main elemnment. The mfrom sensorsed by PWM lows, interrupflows, interru is disabled.vice purposesriggered by pre used to coice. he following Fig. 1. Algorith254 ectly affect life cycle duct life cycle cimplementatiion of the cerf new functioesign stage atime when anramming metthe beginninby NPO «NIKent of the conicrocontrolle attached to tt is invoked tpt is invoked . Its overflowressing buttonntrol the indalgorithm: m of the EHVCthe patient. ring the execan be dividedon, long periotification, butns and impr control syst update is nehods to introg of the deveOR» compatrol system. r performs thhe patient. Ino check the keand data are c causes an ins directly on icators, the kh-80 softwareStrict safetyution of all p into the follods of time pa аlso the deveovement of eem (typicallycessary, a prduce new fealopment stagny. Its program ise following taterrupt occuryboard. hecked with terrupt and rethe instrumeneyboard and .  regulations rocedures. Swing stages:ss between slopers’ need quipment are a microcontrogrammer hatures. To anae, let us con written in assks: s at the end othe patient. Ifading/writingt. the controls arequire oftware tages in to make  also a oller or s to use lyze the sider a sembly f inter- the de- of set-nd ele- The baconditiof the cThis stproblemmicroccorrespwe neeConcluAs a reorder tounderstindepenassigneimportaRefere1. M2. 2. Mre3. AN4. IEce5. GOtem6. IS7. AThttsic steps are ons are fulfillode, device oructure style s with trackiontroller has 3onds to 32 fld to know thesion sult of analyz improve the1. Developeanding of the2. Design m3. The causdent fuses th4. Do not ud to it must nt in critical nces IRA Limited.Warwickshireanual Safety source] – URLSI/ISA 84.0C 61508/615ssed date: 10.ST R IEC Fs. Part 2. ReO/IEC 9899:2mega8535-1p://www.atm performed whed. All majorperation modFig. 2is convenienng flags. A fl1 available rags. If we ch purpose of eaing the archit reliability of rs should no code it shoulust be defenses of dangeroat cut it off, itse bad codingbe describedsystems.  «MISRA-C: , UK: MIRA Integrity Lev:  http://goo.0.01-2004 and11 Safety In03.16). unctional saquirements fo011 – Inform6PU Atmeel.com/imageen the globa procedures aes are checke. Algorithm of tt when the sag error mayegisters, and ange the strucch flag. ecture and theembedded syt put a lot od not be to obive. Softwareus failures m is important  practices. T. Never use 2004 GuideliLimited, Julyel. Andy Ingrgl/IrxoKt (acc Existing Saftegrity Level fety of electrr system . – Mation technoll 8-bit s/doc2502.pd255 l interrupts are executed, ad. It is implemhe interrupt opize of the co result in enabthe programmture of the p code of the stem softwaref confidencefuscated (mad should contaust be prevenfor the develohe purpose oa single varnes for the us 2008 (ISBN ey, Patrick Lessed date: 1ety Instrumen[Electronic rical, electronioscow.: STAogy – ProgramMicrocontrof  (accessed dre enabled. And the flag reented as follo eration in EHVde is small. ling a wronger of EHVChrogram, or remedical devic; it is possible in their sofe confusing)in self-test proted. Althoughpers to rememf each variabliable to conte of the C lan978-0-952415erévérend, Dr0.03.16). ted Systems.esource] – Uc, programmNDARTINFming Langullers [Elecate: 10.03.16)t this time, thgisters are enws: Ch-80 If you increa device opera-80 used 4 oquire additione EHVCh-80 to recommentware’s corre.  cedures. Wor in the descrber about thie must be clerol the devicguage in criti6-4-0). . Andreas HiRL:  http://gable electronORM, 2014 ages – C. tronic reso.   e interrupt dgaged. In othse its size, thtion mode. Af the registersal software , it was foundd the followictness. To fk logs must bibed device ths issue. ar and the fue; this is escal systems». ldebrandt [Eloo.gl/lWVZOic safety-relaturce] – etection er parts ere are tmega8 , which support,  that in ng: acilitate e kept. ere are nctions pecially Edition ectronic A (ac-ed sys-URL:  

Analyzing embedded device programming specifications in critical systems to design programming guidelines

Abstract

Similar works

Full text

Available Versions

Electronic archive of Tomsk Polytechnic University