Wind River Blog Network

Detecting security problems – using static analysis to catch them early and less expensively

By Bill Graham

In my previous post I discussed the potential benefits in quality and costs that static analysis brings to software development. In addition to common coding errors, many of the bugs found by static analysis are potential security defects as well.  Buffer overflow, OS command injection, unrestricted string format and integer overflows are among the top 25 most dangerous security coding defects (according to the Common Weakness Enumeration (CWS) from the MITRE organization). These types of defects are common in C and C++ and are dangerous to correct operation in general but also pose significant security threats – often because the right exploit can lead to arbitrary code execution on the target. Once an attacker can execute code on your device, they can gain complete control, which might include reflashing the firmware, installing malware or rewriting the command and control software.

Continue reading >>

Using Static Analysis to Improve Product Quality, Earlier and Cheaper

By Bill Graham

Fixing bugs is expensive. Fixing bugs is more expensive the later you leave them, in fact, its been shown to cost a magnitude higher with each major phase of development. The famous defect cost chart from Capers Jones shows the cost of a bug going from $25 at the coding phase to $16,000 in development.  Not only that, but most of the bugs are introduced into the system at this stage yet very little of them are found. Logic says we should fix them earlier to save money.

Continue reading >>

Introducing Performance Studio

By Emeka Nwafor

What is Performance Studio? Is it:

1. Some kind of hair product

2. A new "clinic" for MLB players

3. Full name: : Wind River Linux Performance Studio for Intel® Architecture; a new add-on product for Wind River Linux that helps you get the most performance out of your embedded Linux device software running on Intel hardware 

If you correctly answered "3", give yourself a round of applause.

Our portfolio of development solutions have long addressed a broad set of embedded device development concerns in the areas of system definition, bring-up, software construction, integration & test, and maintaining and retro-fitting embedded device software and hardware. Now, with the introduction of Performance Studio, we not only have the broad development solutions portfolio but also further extend it with capabilities that enable us to go deeper into the platform and obtain the best performance out of embedded Linux software running on Intel® Core™, Xeon™, and Atom™ processors. 

Continue reading >>

 

Hacking Insulin Pumps for Fun and Profit

By Ido Sarig

Last month, I had the opportunity to take part in the Amphion Medical Forum in Minneapolis, where the theme was security challenges facing Medical devices. Amphion is a forum that brings together thought leaders from academia, business, government and technology, which was founded to provide a medium for these visionaries to define solutions to some of the issues, such as safety and security, which affect the new interconnected economy, the “internet of things”.

I participated in a panel that discussed the challenges and risks posted by the latest generation of wireless medical devices, and how proper Fuzz Testing, such as the capability offered by Wind River Test Management in conjunction with our partner Codenomicon, can help alleviate some of that risk.

Continue reading >>

A Medical Device Platform: Beyond the Operating System

By Bill Graham

With the release of the new Wind River Platform for Medical Devices it's a good time to point out the breadth of products and services that make up a modern embedded solution suite. In fact, our medical solutions go well beyond the products that make up the Platform. The Platform for Medical Devices provides the main components: VxWorks RTOS, middleware, networking, development tools and BSPs.

Continue reading >>

Test Management 4.0: Reduce Risk by Understanding the Impact of Change

By Ido Sarig

Big day today, we just announced the release of our latest version of Wind River Test Management, WRTM 4.0, the culmination of several years of hard work - kudos to our engineering team!

In the coming weeks, I will be covering many of the new features of WRTM 4.0 in detail in a series of separate posts, but today I wanted to give you an overview of some of the new things you can look forward to.

I’ll start by sharing a quote from Wind River customer GE Healthcare on how Test Management is helping their business -- a real testament to the value that Test Management delivers.

"Wind River Test Management has tremendously helped us improve the productivity of our firmware testing team, significantly reducing the overall development cycle time. And although we already had more than 20 tools as part of our test and development process, test plans and test results were still mostly paper based.  Wind River Test Management easily integrates with our existing solutions, such as HP Quality Center, to provide a complete automated regression testing suite running tests remotely on the target and collecting valuable metrics for tracking test progress and software quality. GE Healthcare operates on a ‘zero defects’ policy and Wind River helps ensure that this policy is met much faster than before."

Continue reading >>

Wind River Turns 30: Looking Back and Moving Forward

By Tomas Evensen 

2011 marks Wind River’s 30th anniversary. The big 3-0…it’s a major landmark moment in anyone’s book. This year, we’ll be taking time to honor this milestone with a retrospective of Wind River’s history and also a series of employee stories.  In my many years with the company, Wind River always impressed on me the concept of  being bigger than just a single product or technology. There is an underlying spirit within our teams that constantly reaches for more, for some greater innovation. While many customers know Wind River for the VxWorks real-time operating system, it was always part of the vision to provide more value. In the early days, this entailed providing a TCP/IP stack and GDB for debugging. Later, additional value came from strong IDE support through Tornado and Workbench. Lately, it has been by providing a choice of operating systems, real-time or open source/Linux. 

A standout example that exemplified the vision of providing a more complete solution was when we embarked on creating a truly embedded hypervisor. In 2004, it had already become clear to us that virtualization would play an important role in embedded designs at some point in the future. In early 2005, Paul Borman who worked for me in the CTO Office created a very impressive prototype, called eCPU, that ran VxWorks and Linux on a single CPU and we learned a lot from that effort. When Johan Fornaeus came on board in 2006 through an acquisition (he was co-founder of Interpeak and before that, one of the co-designers of the Enea/OSE operating system), I had him leading a small nimble task force team to develop a hypervisor really suited for the embedded space. I felt we made a real breakthrough. This was not a repackaged operating system pretending to be something it was not designed for, but instead a truly unique approach to virtualization and separation. Over the next couple years, this small team created a scalable product with an extremely tight footprint, incredible performance, while at the same time being full featured for the common architectures such as Intel, Power, ARM and MIPS.

Back in those days, it was not clear to us when and how important multi-OS systems would be in the future, but today it is hard to imagine how to deal with these new complex systems without a hypervisor for embedded virtualization. Looking at my team’s achievement now, I still marvel at how the Wind River Hypervisor brings together multi-core and our various operating systems. Why choose between operating systems with different characteristics when you can mix them in one system? Throw in a networking stack optimized for multi-core and tools that can debug and find performance bottlenecks and you get a very capable foundation on which our customers can innovate.

By constantly looking to the future, Wind River continues to evolve and further build on its expertise. The ongoing push to innovate may have created interesting and complex challenges along the way. However, it has also resulted in celebrations and breakthroughs, and it’s undoubtedly a big reason why so many of us continue to stay on the ride. 

 

Autonomy and Robotic Advancement

By Mike Deliman

A few months ago at the Robotics Virtual Trade Show, in my presentation I spoke about the evolution of robotic systems.  One thing I predicted was as time goes on, robots will become more independent and autonomous, performing more of the work humans and mainframe-style systems have traditionally performed.  

Among the robots I talked about were robots similar to NASA's 
Stardust Spacecraft  Stardust is currently on course for a Valentine's Day rendezvous with Comet Temple-1.  Stardust includes a package that performs autonomous navigation, d to help keep the craft on it's flight path with reduced intrusion from ground-based systems.  Since Stardust is so far out from earth, there is significant delay in round-trip communications.  Stardust is able to detect problems in trajectory and perform course correction maneuvers on its own.

Last week, Northrop Grumman had  first-flight for an evolution in Un-maned Aerial Vehicles.  The 
X47B UCAS   is an autonomous unmanned flight system.  It is not a wireless-joystick system.  It flies itself, taking off, figuring a course to it's way points, landing.  Without human intervention.

Continue Reading >>

 

The Virtual Basil Fawlty

By Jakob Engblom

In the 1970's BBC comedy show Fawlty Towers, John Cleese manages to turn harmless everyday situations into total disasters, with very little effort. It is a marvellous example of how to inject faults into what could have been a smoothly operating hotel, and demonstrating just how things fall apart as the unexpected happens. Injecting faults isn't always that easy, unfortunately (or should that be fortunately)?

I recently read an article by Steve Chessin in ACM Queue about fault injection, where he discusses how the UltraSPARC II and III systems from the late 1990s and early 2000s supported hardware fault injection in order to test the ability of the system to recover from faults. In this case, injecting faults was a bit more difficult than roaming around in a hotel beating your hapless waiter with a frying pan or insulting the guests. In the article, he makes a very important statement:

Continue Reading >>

It's a Beautiful Day

By Emeka Nwafor

I have been totally absorbed by the media coverage of the incredible rescue of the thirty-three Chilean miners that were trapped about a kilometer below the earth's surface for months. The images of jubilation as "Super Mario" and the other miners exited the pod will be imprinted in our minds forever. A real Feel Good Story.

Many thanks to the scientists, engineers, and rescue specialists from across the planet for playing their part in bringing up the 33 miners and 4 rescue workers and for making this A Beautiful Day.

Between reports of the rescue of the individual Chilean miners, CNN's report on the "Best Jobs in America" caught my attention, my curiousity, and briefly diverted my focus from the rescue (and my day job). Of the top-100 jobs, I was pleasantly surprised to see that "Software Architect" ranked at the top - #1 in America. "Product Management Director" and "Software Engineering/Development Director" were in the top-20 - this was a pleasant but credible surprise. "Telecommunications Network Engineer", "Test Software Development Engineer", "R&D Manager", and "Systems Engineer" were all in the top-50. Very interesting considering that these rankings are based on criteria like compensation, job growth, and quality of life.

Continue Reading >>

Physical or Virtual

By Jakob Engblom

When you explain what a virtual platform or full-system simulation solution like Wind River Simics is, a key part is that it runs the same software as a physical board or physical system. This does capture the core of the idea - but it does not mean that the virtual platform is only "just like the real thing".

Comparing virtual and physical systems is like comparing apples and apples, not apples and oranges: while apples are mostly interchangeable, they is certainly variation between them. Some apples are best for eating, some are better for making sauce, some are pie material, and some are best for fermenting cider. The type you select depends on what you want to cook. The difference between physical and virtual hardware is similar: they can be used as replacements for each other to some extent, but the connoisseur can make much better use of both by looking at the differences.

Continue Reading >>

Intuitive & Efficient Debug of Multi-core Systems

By Brian Finkel

I reflect on a recent visit with my 84-year old Aunt Honey. As you might expect, she is not an avid cell phone user. She wanted help entering contacts into her phone. She has a basic phone so we had to enter text using the “9-up” keypad. Her objective is to make phone calls by selecting someone’s name instead of typing the telephone number.   

The event had me thinking about the way we used to make telephone calls – using an address book or a phone list and then typing in the number. In my youth, things weren’t so bad – everyone lived in the same town – with the same area code and only a few prefixes. For each friend you only had to remember the 4 digits and perhaps which prefix to use. Fast forward a few years and with the advent of cell phones, IP telephony, new area codes, and geographically-dispersed friends and family – you now need to remember 10 digits. 10 digits is beyond most people’s working memory (which is typically 7 digits). Address books and phone lists were required. 

Continue Reading >>

A Few Words About the Future

By Amit Nandi

I recently started reading a book called “I Live in the Future & Here’s How It Works” by Nick Bilton.  I got interested in the book after reading an excerpt online at the New York Times, where Bilton is the lead writer for their technology blog. This is where my life started imitating art.

While I was waiting for the e-book to download, I read on to the second half of the excerpt. Bilton describes a nifty rule he calls “1, 2, 10”; numbers that describe the distance between your eyes, the screen of a mobile device, computer screen and television screen, respectively.  He asserts that content will eventually follow us from screen to screen and place to place. While this exact future hasn’t happened yet, a reasonable facsimile of it was taking place in a race between the downloading of his book both on my computer and my iPod touch. Having the content accessible on a large monitor during the day and at bedtime is really handy when you’re writing to a deadline.

Continue Reading >>

Variable and Deterministic

By Jakob Engblom

A virtual platform like Wind River Simics is generally designed to be deterministic. Determinism brings a host of benefits to users (repeatability of bugs, reverse execution, bug transportation, etc.), but is also easily misunderstood. Quite often, users fear that they will lose an important "feature" of a physical machine - its built-in variation across runs of the same software. If the virtual platform is deterministic, surely it will not expose all the different ways a program can run that you get on a random physical machine? Yes it can.

There is a huge difference between the repeatable determinism of a virtual machine and completely invariant, predictable, predetermined behavior.

Continue Reading >>

Test Automation Meets Simulation

By Paul Henderson

I'm seeing increasing interest from many companies in using simulation environments with test automation systems to accelerate the testing process. Specifically, putting Wind River Test Management together with Wind River Simics is getting creative juices flowing in industry thought leaders.

Why? Well, development teams have started to realize the benefits of simulation systems for speeding and validating system and software design, and for accelerating software development and debug in advance of hardware availabilty. And even when hardware is available, systems like Simics provide tremendous access and control to speed analysis and diagnsotics.

Continue Reading >>

Wind River and IBM Attack Software Quality

By Paul Henderson

As I've mentioned before, we've been working with IBM Rational for some time around quality management automation. Both companies see the skyrocketing software content and architectural complexity in the embedded device market as creating a tipping point where companies will not be able to continue with business as usual.

Product development teams will need to take a more managed and automated approach to quality that spans across the lifecycle and access into the devices under test. This is particularly true in markets that require strict adherance to standards and compliance regulations.

We put together a joint whitepaper on this subject downloadable from here. And we are also having a joint web seminar next week on Tuesday Aug 31 at 2pm EDT. You can register for this event here.

Continue Reading >>

It’s Time for Testers to Step Up

By Paul Henderson

RTC Magazine recently published an article that I wrote called "Time to Rethink Software Testing for Embedded Devices". In it I describe some of the new techniques that are possible, and I believe necessary, to delivery high quality device software for embedded devices.

• When staying 'positive' doesn't pay
• Getting negative with white box testing
• Focusing on the 'deltas' with change-based test automation

Continue Reading >>

Test Driven Development Meets Continuous Integration

By Paul Henderson

In my last posting I mentioned I'd be running a webinar with James Grenning on Agile testing. James is a recognized expert and frequent speaker on the topic of software development and one of the original authors of the Manifesto for Agile Software Development.

We talked about the case for agility where today's embedded software projects are inevitably faced with changing requirements and market conditions that cause unplanned, mid-course corrections. The result is what went in is often not what was expected to come out. Testing folks are the tail trying to wag the dog as they try to test in quality at the end of the project.

Continue Reading >>

Industry Investing in Better Device Runtime Visibility During Testing

By Paul Henderson

Here’s the final installment in my series about our embedded device software industry testing survey conducted in April-May 2010 with almost 900 respondents (see previous blog postings).  If you’d like a copy of the full report in pdf, please drop me an email at paul.henderson@windriver.com and I will send it to you.

In this section of the survey we asked participants about what test tools they use today and where they are investing in test automation. Given the high cost of product failure, accelerating complexity and reduced schedules the industry is turning to more test automation in 2010 to help address these problems. The top investment are moving to new tools that can help test teams and their management better understand how well they are testing, better focus their efforts on the areas needing testing, and reduce cycle time through more automation.

Continue Reading >>

The High Cost of Poor Quality – Brand, Market, Budget

By Paul Henderson

I’m continuing my series on our embedded device industry software testing survey conducted in April-May 2010 with almost 900 respondents (see previous blog posting).  If you’d like a copy of the full report in pdf, please drop me an email at paul.henderson@windriver.com and I will send it to you.

In this section of the survey we asked participants about how they measure the high cost of poor quality. Respondents told us that the true cost of poor quality is much higher than program budget. The majority of respondents showed that the true cost of poor quality is measure by damage to company brand and lost revenue due to missed market windows.

Continue Reading >>

When is Scripting really Programming?

By Jakob Engblom

I recently updated some analysis scripts in Simics to use the new OS awareness framework in Simics 4.4. While doing so, I completely updated the structure of the code, ending up with something looking suspiciously like a regular Python program. It had declarations, classes, variables, did not rely on global variables, and was fairly robust to changes in the target. This got me thinking about the difference between "scripting" and "programming". When I was a computer science undergraduate in the 1990s, I recall the difference was very simple. Programming was done in C or other real languages (with the corresponding heated debate on whether anything except C or assembly counted), scripting was done in bash. For some reason, it does not feel that simple today.

Continue Reading >>

Inadequate Management Visibility into Quality is Eroding Confidence

By Paul Henderson

Here’s the next installment in my series on our embedded device software industry testing survey conducted in April-May 2010 with almost 900 respondents (see previous blog postings).  If you’d like a copy of the full report in pdf, please drop me an email at paul.henderson@windriver.com and I will send it to you.

In this section of the survey we asked participants about how they measure software quality today, the metrics most often cited by survey respondents were reactive in nature such as tracking customer-reported failures and open defects rather than metrics that can help them prevent defects.

Continue Reading >>

Compressed Schedules Driving Shorter Testing & Defect Resolution Requirements

By Paul Henderson

Today I'm continuing my series on our embedded device software industry testing survey conducted in April-May 2010 with almost 900 respondents (see previous blog posting).  If you’d like a copy of the full report in pdf, please drop me an email at paul.henderson@windriver.comand I will send it to you.

In part 2 of the survey we asked about schedule compression and what affect that was having on the device testing cycle. A majority of survey participants reported that market conditions have forced them to shorten their development schedules by as much as 18 months.

Continue Reading >>

A Crisis of Complexity – Industry Report on Growing Challenges in Embedded Testing

By Paul Henderson

I’ve been talking a lot with embedded device companies around the world over the last few years and I am hearing growing concerns about software testing. I’ve mentioned several of these concerns in previous blogs. I wanted to get more quantifiable data and get some feedback that could help us shape our products and services to help. So I decided to run a survey to gather important data from our community.

The focus of this survey was to gain a detailed snapshot of how executives, development managers, QA and test team leaders and other involved staff currently view the embedded device software quality test landscape. Recent changes, new challenges and strategies for managing them were of particular interest.  So I fielded a four-part survey to individuals who work for embedded products companies. In total, nearly 35,000 individuals in North America were invited to participate in the survey via emails. 

Continue Reading >>

What’s New in Wind River Test Management 3.3?

By Paul Henderson

Today we announced the latest version of Wind River Test Management, Release 3.3, our test automation system for monitoring, executing and managing embedded device software testing. Wind River Test Management lets teams optimally execute complex tests while dynamically gathering information from the production software under test as it is running, without requiring special pre-instrumented software builds. This approach allows teams to adopt new white-box test techniques that give testers visibility into the operation of the device and help them determine the thoroughness of the tests, quickly identify defects and performance bottlenecks, and focus efforts on sections of software that are most in need of testing.

Release 3.3 is a major new release that adds a number of significant new features. You can learn more and download several new whitepapers from www.windriver.com/products/test_management.

Continue Reading >>

What is Simics, Really?

By Jakob Engblom

As you might have seen, Wind River recently acquired Simics, a product formerly sold by Virtutech. My colleagues Michel Genard and Bill Graham recently blogged on the topic.

Simics can have a huge impact on the product development processes, time-to-market and quality. Apart from the cool things that Simics does to improve the development process, it is also a very interesting technology in and by itself.

Continue Reading >>

So, What Does _Your_ Software Architecture Look Like?

By Mark Hermeling

Customers often ask me in my opinion as to what their path to multi-core should be. Invariably I ask them two things. 1) Describe your current hardware architecture, your next hardware architecture and what your hardware architecture will look like in 3 years; 2) Describe your current software architecture and any plans you have to evolve it.

This leads to interesting discussions, most customers can draw their hardware architectures, some can white board their software architectures easily, some have more problems, but I have a strong feeling that their drawing differs significantly from the actual implementation.

Continue Reading >>

ESC Silicon Valley

By Mark Hermeling

Looking forward to my trip to ESC Sillicon Valley next week. It is promising to be a busy show, especially since ESC is now combined with the Multicore expo. I just leafed through the agenda (in the form of a Nxtbook) and found a large number of sessions that I want to attend, experience show though that I'll probably be too busy talking to customer to attend sessions, which is a good problem to have of course.

I am hosting a 4 hour session (with several of my colleagues) on Multicore Demystified on Tuesday afternoon 2.30-7pm (there will be refresments!) in the Hilton Plaza Room. Do stop by either the session, or our booth at Multicore Expo for a chat if you want to brain storm about your next generation devices.

Continue Reading >>

The Ultimate Head Start

By Bill Graham

I was very excited on hearing about Intel's acquisition of Virtutech and subsequent announcement that Simics was going to be part of our product line. Why? Because Simics gives you access to hardware platforms before they're even made (including multicore platforms.)

In my experience, access to hardware platforms and having enough for everyone is a constant concern during development. Many developers are targeting their new product for new hardware platforms that are still in development and hoping for the stars to align so their software and the hardware platform delivery dates align. Now, if you are on this bleeding edge of technology what can you do to ensure success?

Continue Reading >>

Quit Bugging Me: What Tool to Use?

By Mike Deliman

When you're debugging a process, or a system, you never can be sure were it will lead you.  Sometimes you need special tools to find out what's happened.  Sometimes you just need a little extra visibility into the system.

When you have a specific bit of code that runs, and that bit of code always fails the same way, you're at least starting with a defined test case and a known / expected failure syndrome.  A real challenge is when the system seems to fail with a random set of symptoms - perhaps there are a few specific symptoms but you can't predict which will strike, or to what task, or when.

Continue Reading >>