IRC logs for #trustable for Wednesday, 2018-09-19

*** toscalix has joined #trustable07:50
*** iker has joined #trustable08:04
paulsherwood resolves to the gitlab pages page09:32
paulsherwoodis shaun still on holiday?09:32
ikerhe is back09:33
*** Shaun has joined #trustable09:41
Shaunpaulsherwood: Apologies my IRC didn't have freenode as auto join, back today so been doing some catchup reading09:43
paulwaters_flatmush - standup?09:49
flatmushI guess, sorry was busy10:01
flatmushSTANDUP! Order: flatmush, iker10:03
flatmush## Ben Brewer (flatmush)10:03
flatmush* Done10:03
flatmush  - Attempted to upstream git patches, but the build cycle takes too long.10:03
flatmush  - Started work on junctioned version of freedesktop-sdk based minimal-distro.10:03
flatmush* Doing10:03
flatmush  - Read Olwens e-mails and respond10:03
flatmush  - E-mail about current status of minimal-distro and any issues10:03
flatmush  - Getting minimal-distro to build using freedesktop-sdk elements.10:03
flatmush## Iker Perez (iker)10:03
Shauniker is away from his desk so I'll go10:04
ShaunAlso I'm back lol10:04
Shaun## Shaun Mooney10:04
Shaun* Done10:04
Shaun  - Drawn control model functional diagram10:04
Shaun  - Pushed control diagram to repo10:04
Shaun* Doing10:04
Shaun  - Project catchup10:04
Shaun* Next10:04
Shaun  - Writing up autonomous car STPA10:04
Shaun    - Losses and Hazards10:04
Shaun    - Detail responsibilites and control actions10:04
Shaun* Issues10:04
Shaun  - None10:05
Shaun## Iker Perez ( iker )10:05
iker* Done10:12
iker   - Add  gitect to av-stpa repo10:12
iker* Doing10:13
iker    - Debug gitect code in av-stpa and minimal-distro repos10:13
iker    - Understand Flatpak SDK10:13
iker    - Analyse the way the minimal distro uses buildstream10:13
iker* Next10:13
iker    - Change the way in which fredesktop is installed10:13
iker# Craig Griffiths?10:13
flatmush# Discussion10:14
flatmushSTANDUP ENDS!10:15
paulsherwoodShaun: have you done a scan of prior art, to see if there is any existing STPA work we can benefit from?11:20
paulsherwoodfor example.... see second-last page11:29
Shaunpaulsherwood: I have had a quick look but nothing in detail. I was going to look in more detail now I have my own initial diagram to see how they differ11:50
paulsherwoodi think there is more detial in the mit diagram, so i suggest we modify ours to include it, and reference the original work in the commit?11:50
paulsherwoodalso i think i'm backtracking from my previous idea that the diagram for autonomous could be the same as normal vehicle11:52
paulsherwoodarguably the mit diag is more like an existing design11:52
paulsherwoodwhereas for av, maybe that's too prescriptive (since those controllers might not be present  in av - achieved in a different way perhaps)11:53
paulsherwoodi think i've just said conflicting things :-)11:53
ShaunYes I was wondering how much detail we should go in. I think there is a balance we need to strike between keeping it high level enough to allow users to have their own design i.e. not be too prescriptive, but it needs to include enough detail to actually be useful11:55
paulsherwoodcan dihaa render colours? would be nice to distinguish between control signals and feedback11:56
ShaunFor example I'm not sure we need to get into air conditioning, but the idea of including electrical load into the design is something I hadn't thought, and a high level section for "electrics" is a good addition11:56
ShaunI don't think it can do colours on arrows11:56
paulsherwoodNancy Leveson mentioned yesterday an airline battery overheat problem... where one safety system detect smoke, but another shut down some functions (including that safety system) in the event of too much power drain...11:58
paulsherwoodShaun: presumably you have seen ?12:01
ShaunShutting down safety systems doesn't seem too clever. I'll have a look for prior art and see how they include electrical safety. Did Nancy mention if they had done STPA on that airline battery problem?12:02
paulsherwoodshe didn't, but it was an actual incident, made the news, so i would expect stpa had not been done12:03
ShaunI've got that PDF but haven't read through it yet, it points you to read the handbook and the actual first12:06
paulsherwoodbut it also provides a tutorial, which i would expect to be helpful in learning the method12:07
ShaunYes the tutorial seems extremely useful12:08
* paulsherwood wonders if there's an explicit convention in STPA diagrams that control goes down, feedback goes up12:19
* Shaun has seen them go sideways12:20
Shaunbut hasn't seen any feedback go down or control actions go up12:21
ShaunI do think it's explicitly written that control should flow down, with a hierarchy of controllers. For example the diagrams including government and legislation have the president or congress at the very top and an employee completing a task near the bottom, with a management structure inbetween12:27
* paulsherwood notices that Shaun should have offered a MR of losses...12:48
* Shaun adds MR13:05
ShaunI've just added the .md with a list of hazards and losses. I'll add an issue to generate a pdf from that and the diagram13:05
* paulsherwood adds comments13:11
* paulsherwood wonders if there's any way to get the ci to actually report some gitect evidence, rather than just say 'it ran'13:12
paulsherwoodShaun: just fix the s/breaking/braking/ and i'll approve13:35
Shaunpaulsherwood: +1 to your comment about a small list to begin with. The list of losses is largely from one of their examples, and the material seems to say start small then expand later on13:38
ShaunI've just updated the spelling mistake13:38
paulsherwoodsorry... pls comment on what is environmental loss?13:39
Shaun"Environmental impact" would probably be more appropriate13:41
paulsherwoodwhat kind of thing are you meaning?13:42
ShaunExcessive fumes I guess would be the big one, or just generally driving in an eco way (no excessive accelerating for example). Again this was on their list, and it seemed a good idea to include. Once we expand on the hazards it might turn out that non of them are linked to this loss, but I thought it was worth having on the list.13:47
ShaunWhich makes me realise the hazards list is incomplete because I haven't done the link to losses13:47
Shauni.e. put which losses each hazard could lead to13:47
paulsherwoodok pls fix that and restate as impact, and *then* i'll approve :)13:51
Shaunwill do13:51
Shaunpushed the updated. To be honest, I'm not 100% sure of the loss list, as it seems like most hazards *could* lead to all of the losses, but I've just followed their examples and I guess it will become more obvious what's important to list as we get better at STPA14:20
paulsherwoodShaun: you need to decide... L-1 or L1 etc14:21
Shaunpaulsherwood: oops. fixed14:24
* paulsherwood squashes and merges14:36
paulsherwoodiker: pipeline failed?15:09
ikerI am adding a new test to the branch15:09
ikerit will test the markdown text, it has some bugs that I need to fix15:10
ikerbut the previous version should be ok15:10
*** paulwaters_ has quit IRC15:23
*** toscalix has quit IRC16:14
*** Shaun has quit IRC16:52
*** iker has quit IRC16:54

Generated by 2.15.3 by Marius Gedminas - find it at!