STM32F4 GCC v10 to v11 - some weird error messages

[paulca]

You said that compliance and quality certificates are invalid concept in embedded systems. 

I gave you a real example where someone went to prison for poor quality code.  It was meant as a cautionary tale on professional negligence and it's civil and criminal ramifications for embedded systems and industrial systems in particular. 

Industrial systems, I would imagine, have to comply with various health and safety regulations or the insurance will not cover it's liability etc. etc.  Such as a control system with no "STOP" button.  No false-safes and lockouts.  Even, maybe, to the extent of ensuring that your device can only be accessed/configured or used by authorised and trained personnel.

Does your system not do reporting?  Does it have any external management interfaces?  If so, they need secured. if it's only to prevent "Accidental or malicous tampering by internal bad actors"

Do you have professional liability insurance?

[peter-h]

I think those building life critical systems are not going to be posting on EEVBLOG

Does it have any external management interfaces?  If so, they need secured

They are and this is documented.

[Siwastaja]

I think those building life critical systems are not going to be posting on EEVBLOG

I have seen you say something similar a few times before, and I think it's quite arrogant. This is a surprisingly popular forum among some world-class experts, of course many don't make a big deal about it. A few posters who build safety critical systems where failure would result in loss of life come into mind, and they have discussed how tight the regulatory processes are. I'm glad I'm not one of them - at least yet - because of how stressful it must be.

[paulca]

I don't develop life critical systems, but I do develop critical infrastructure with billions of dollars in flight daily.

I am also under international legal regulation, and need to comply with a raft of stuff around money laundering, sanctions, foreign actors, insider trading, tipping, etc. etc. etc.  There is mention of 15 years jail time, plus fines totalling twice the profited amount.

However, appealing to extremes asides.  Software license agreements have to be VERY carefully written.  Software development contracts have to be very carefully written.  When I say, "very carefully written" I mean your contract terms and conditions must be compatible with your insurance company, in addition to any local regulations and laws.

An EXTREMELY important aspect is the "Limited liability" clauses.  If they don't hold like concrete in court you can be screwed over for whatever the customer believes your software cost them.  So if your devices goes "dead" for 48 hours and it brings a production line to a halt for 48 hours, that could amount to $500,000 in lost revenue claimed against your failure to provide what you contract stated you would. 

A "fair" limit on liability to strive for is "Liabilities not exceeding the total contract cost.".  So if after the software + consulting + support they have paid you (invoiced) $16,000.  If that software deletes all their company records and causes $3 million in damage, you only get screwed for $16,000.

Get insurance.  Make sure your contracts are written well.  Spending a few hundred dollars to have a lawyer review your contracts might save you a few thousand in legal fees later.  Legal fee insurance as part of your professional and third party liability insurance package is usually standard.

[paulca]

They are and this is documented.

You pushed back on the security and said you didn't see a need for it.

So it's either secured or not.  If the security is inadequate it will not matter if it was documented or not.  It will result in damages being filed your way in civil court.

If they get an industry expert to take your code apart in that court.  God help you.

Do note, by selling them software services you are operating as a software professional.  As that is an recognised engineering discipline (in most circles), it comes with inherent professional conduct and integrity implications which the court will lean on.  That is how "Professional negligence" is a real criminal thing.  Engineers need to hold a reputation to hold trust.  Engineers who are fraudulent or incompetent need to be called out and dissociated, distanced.

Software industry is rampant with "free spirits" and I wouldn't stop them, honestly.  Tear away.  Just be aware, if you embarrass the industry, no expert engineer will get in the stand to defend you.

[peter-h]

of course many don't make a big deal about it.

Sure there will be some but they will make sure they don't post the details, due to e.g.

- company social media policy - likely to be extra tight in high legal liability cases
- a "big money" business will not want to advertise their next product (I have seen amazing contrary cases and they are still on google but they were posted ~20 years ago, along with full company name, and people learnt their lesson since)
- most devs doing complex work don't want to do "free education" (I know contrary cases but they are rare)

[paulca]

Its a problem which is detrimental in ways to the industry.  That which means the higher engineers are more likely to be restricted in what they can discuss.

EEVBlog is really an excelent forum.  In software beyond beginner level or maybe intermediate level in open source projects...  In the real bleeding edges it's either in University or in a private company and entirely proprietary and thus, there are very, very few places on the internet you can discuss these things.  People just don't talk about these things because they are buried under NDAs and regulation.

I play a more dangerous game.  As long I don't make it clear where I work or who for and as long as I keep my topics to "generic technological" / "professional discussions" with no context which relates that towards any company I have worked for in the last few years.  I should be fine. Based on how I read the disclosure documentation.

I might use a Rabbit MQueue pattern to deliver a proprietary system.  I feel I am free as a software profressional to discuss, even in public Rabbit MQueue patterns and practices.  As long as I don't get too close to the proprietaries.

The risk that I personally run with that is "doxing".  That could change a few things.    i think I'm okay.  I don't believe I have ever devulged any information which was not effectively public.

The worst is when someone thinks they are calling you out by saying you provide no evidence that you are even what you say.  That's why in the past my response is "You don't pay my salary, luckily."  The reality is, I could probably point to a few real world systems which people would be aware of, which I may or may not have worked on.  I just choose, profressionally to avoid doing so and only from a graceful period in the past.

[peter-h]

Its a problem which is detrimental in ways to the industry.  That which means the higher engineers are more likely to be restricted in what they can discuss.
EEVBlog is really an excelent forum.  In software beyond beginner level or maybe intermediate level in open source projects...  In the real bleeding edges it's either in University or in a private company and entirely proprietary and thus, there are very, very few places on the internet you can discuss these things.  People just don't talk about these things because they are buried under NDAs and regulation.

I agree, and have written this loads of times. It is why so much open source code is junk and with nobody supporting it. People get so far, post it, and then

- they abandon it (working or not) but leave it published
- the continue with it as a commercial product but don't publish anything beyond the original (working or not) code

Anyway, back to topic, v11 generates slightly smaller code than v10 - about 1% less.

[DiTBho]

you are the prototype of the ignorant person who doesn't even spend half a minute studying by himself, doesn't pay for personal tecnical courses, doesn't thank people when they teach something, instead prefers to (ab)use other people's time for every stupid things, even complaining about open source.

congratulation

[peter-h]

You are very wrong, but you are welcome

[Siwastaja]

Remember when I said I think you are the one who is rude, peter-h, and you dismissed it as me being a mental health case, demonstrating said rudeness. See? I'm not the only one who thinks that way.

Complaining and self-victimization is a thing, I used to do that a lot but it's a huge productivity killer. I still sometimes end up on those wrong tracks when stressed out, finding myself using my cognitive capacity to come up with clever ways of explaining why something is crap, when I should be using that very power to find ways around that crappiness.

I can't fully remove my inner pessimist, but I have learned to make my rants quick. So I write a short, aggressive comment in code of something being crap, and then try to move on ASAP. If I already wasted a day due to some stupid bug or poor documentation, then I don't want to waste another day in aftermath. Just keep going on.

[paulca]

I still sometimes end up on those wrong tracks when stressed out, finding myself using my cognitive capacity to come up with clever ways of explaining why something is crap, when I should be using that very power to find ways around that crappiness.

This.

For better or for worse I find the ratio of requests for help on forums that I start and the ones I send is about 100:1.  Because, most times, writing the message and explaining the problem clearly to an audience is enough to solve the problem or uncover a new lead or a new direction and so ... you don't send the message, you go off and investigate that lead first.

The other type of message I am (hands up) guilty for is the "pre-emptive help" style message.  I see something and I know it's going to take me days and days of research to understand and so I will often put up a generic discussion topic to see if I can learn anything the quick way... aka cheating.  While at the same time starting into that research in parallel.   Different audiences appreciate these types of messages in different ways.

[DiTBho]

You are very wrong, but you are welcome

now you are in my ignore list.

[Simon]

I think those building life critical systems are not going to be posting on EEVBLOG

Does it have any external management interfaces?  If so, they need secured

They are and this is documented.

cough, cough, cough, guilty! It was life support actually! what was worse was that me posting here was utter sanity compared to what went on at the company some times.