Sunday, July 4, 2021

Government is now mandating safer software

 


In the late 90's I was invited to attend an event sponsored by National Institute for Occupational Safety and Health (NIOSH).  It was about how software sucked and was unsafe.


I saw the handwriting on the wall that someday the Government would start regulating software, because industry wasn't (Management sees it as a waste of time and more importantly Their money).  I started my Software Safety site way back then and became a Certified Software Quality Engineer (CSQE from ASQ).  I expected someday there would be a need for people, such as myself, that could review software for correctness, especially in the Embedded System area.  It has taken far longer than I expect for the Government to start mandating safer software.  That day has arrived.


This is about TicTok.  However they make no distinction about 'connected software' from embedded devices such as Their '(d) end-point-device'.


https://www.whitehouse.gov/briefing-room/presidential-actions/2021/06/09/executive-order-on-protecting-americans-sensitive-data-from-foreign-adversaries/


"... In evaluating the risks of a connected software application, several factors should be considered.  Consistent with the criteria established in Executive Order 13873, and in addition to the criteria set forth in implementing regulations, potential indicators of risk relating to connected software applications include: ownership, control, or management by persons that support a foreign adversary’s military, intelligence, or proliferation activities; use of the connected software application to conduct surveillance that enables espionage, including through a foreign adversary’s access to sensitive or confidential government or business information, or sensitive personal data; ownership, control, or management of connected software applications by persons subject to coercion or cooption by a foreign adversary; ownership, control, or management of connected software applications by persons involved in malicious cyber activities; a lack of thorough and reliable third-party auditing of connected software applications; the scope and sensitivity of the data collected; the number and sensitivity of the users of the connected software application; and the extent to which identified risks have been or can be addressed by independently verifiable measures. ...


(d) The Secretary of Commerce shall evaluate on a continuing basis transactions involving connected software applications that may pose an undue risk of sabotage or subversion of the design, integrity, manufacturing, production, distribution, installation, operation, or maintenance of information and communications technology or services in the United States; pose an undue risk of catastrophic effects on the security or resiliency of the critical infrastructure or digital economy of the United States; or otherwise pose an unacceptable risk to the national security of the United States or the security and safety of United States persons.  ...


Sec. 3.  Definitions.  For purposes of this order: (a) the term “connected software application” means software, a software program, or a group of software programs, that is designed to be used on an end-point computing device and includes as an integral functionality, the ability to collect, process, or transmit data via the Internet; ..."



http://www.softwaresafety.net


Monday, June 25, 2018

When Pain is Relentless

My interview for Migraine Awareness Month: When Pain is Relentless.

 I was once very active in many LinkedIn groups, then my wife Karen took her own life to stop the relentless pain from Intracranial Hypotension due to Cerebrospinal Fluid (CSF) Leaks. A condition that is more common that many think (for example Actor George Clooney had/has a CSF Leak and considered suicide), yet is so unknown that some doctors argue the condition does not even exist.

Part of the problem are Fluoroquinolone antibiotics maimed her for life. I'm now up to 34 people that have told me their own CSF Leak started after taking such antibiotics as Cirpo, Levaquin, Avelox etc. There is ZERO researching on this connection because no one else connected the dots. Please help me change that. http://www.kpaddock.com/fq.

Wednesday, June 20, 2018

The death of Gimpel Lint. Do you read your license agreements?

I have long been a fan of Gimpel Software LLC's Lint product for doing static analysis of my projects.

I was excited about buying the new "PC-lint PLUS" version, even with the price increase. That is until I actually read their license agreement.

First we need to take a step back and discuss license agreements. Do you actually read the license agreements before or after purchasing/licensing your software/firmware? You really should as you may find something you don't agree with, for example from my own license agreement:

"...General:
This License is the complete statement of the agreement between the parties on the subject matter, and merges and supersedes all other or prior understandings (no mater how conveyed), purchase orders, agreements and arrangements. This License shall be governed by the laws of the Commonwealth of Pennsylvania. Exclusive jurisdiction and venue for all matters relating to this License shall be in courts and fora located in the Commonwealth of Pennsylvania, and you consent to such jurisdiction and venue. You agree to grant The Designer-III Company, LLC a non-transferable option to claim, for now and forever more, your immortal Soul. Should The Designer-III Company, LLC. wish to exercise this option, you agree to surrender your immortal Soul, and any claim you may have on it, within five (5) working days of receiving written notification from The Designer-III Company, LLC, or one of its duly authorized minions. There are no third party beneficiaries of any promises, obligations or representations made by The Designer-III Company, LLC, herein. Any waiver by The Designer-III Company, LLC, of any violation of this License by you shall not constitute or contribute to a waiver of any other or future violation by you of the same provision, or any other provision, of this License.
...

As no one has ever commented on the binding agreement on their Soul I surmise that no one has ever actually read the text when they clicked 'Agree' on the installer.

Returning to Gimpel, as I read their license agreement, MANY times, it seemed to state that I must buy a copy of Lint for every project that I analyze with PC-lint PLUS.

To make this more tangible lets use the analogy of a contractor building a house. You generally expect the contractor to have their own fundamental tools such as a hammer.

Now according to the Gimpel license agreement, for every house (project) the contractor builds, the contractor (you or I) must buy a new hammer. At the completion of the house, the hammer is left with the customer whom contracted for the house to be built. That the customer has no use for a hammer or does not knows its correct and safe usage is irrelevant.

So if your build three houses, or projects, you must purchase three hammers (copies of PC-Lint PLUS).

When I raised this absurdity with Gimpel, in a length email exchange, they gave me the option of buying a reusable hammer (I can use PC-lint PLUS all I want for anything as a consultant working on software for a client for a limited time) at the cost of $9980! I must give credit to the lady in sales that I was working with, whom was sympathetic to my view. Alas management above her was not.

I feel like I have been selected for personal punishment by being honest, and following the rules of actually reading the license agreement. I'm sure most people don't and simply buy one hammer (PC-lint PLUS) and go on their way.

Gimpel's position is that it was a lot of work to update their Lint product to match modern C++ proclivities and they need to be paid for that time consuming hard-work. I expect to be paid for my work as well, so I can empathize with their position, yet not at all with their current solution.

What do you feel is a better solution?

Using PC-lint PLUS with Open Source code also appears to be a problem. Saying a change was made to remove Lint error #123456 or using a Lint suppression directive around a section of code is apparently not allowed.

Now to be compliant with "5. OWNERSHIP" I must state, if we actually pony up the nearly ten grand for this new version, to be compliant with the PC-lint PLUS license agreement:

"

...Whenever You make any formal (written, printed or oral) reference to PLUS, such representation shall be accompanied by a reference to Gimpel as the developer of PLUS. However, such reference shall not be represented as an endorsement by Gimpel.

You agree that You will not represent Gimpel as endorsing or making specific claims regarding your organization, your products or your services thereof without the express written permission of Gimpel.

..."

I'm sure as the intelligent person that you are, you know Gimpel is not endorsing this particularly blog entry or The Designer-III Company, LLC. Must be true to the license agreements do we not?

I really wish we could get the world to move on to functional languages like Elixir and leave C and C++ in the dustbin of history where they belong today.

Elixir is a dynamic, functional language designed for building scalable and maintainable applications. Elixir leverages the Erlang VM, known for running low-latency, distributed and fault-tolerant systems, while also being successfully used in web development and the embedded software domain.

Sunday, May 29, 2016

When is it time to say 'No' designing a pain giving device?

I just came across the Pavlok a device that by design is to cause pain; Reference: Pavlov's Dogs.

THE FIRST DEVICE THAT BREAKS HABITS BY DELETING TEMPTATION.
PAVLOK ASSOCIATES A MILD ZAP WITH YOUR BAD HABIT, TRAINING YOUR BRAIN TO STOP LIKING THE HABIT.
THE ZAP IS AN ELECTRIC SENSATION THAT RANGES FROM PLEASANT TO SLIGHTLY UNCOMFORTABLE.
I realize the debate about designing weapons that kill people have been going on forever and we are not likely to have answers to that debate here.

What happens when the software in the device or its control app have bugs? What are the security of the device being 'hacked' or used by the mysterious evil 'Them' (fill in your choice of conspiracy group)?

The one that really puts it over the top for me is linking this pain giving device to Smart Meters. Set your thermostat to high you get Zapped. Is this really the world we want to be creating with the Internet of Things (IoT)?
'Road to hell'

...Prof Alan Woodward, a cybersecurity expert from Surrey University, said the more connections which are made between devices, the greater the risk of a security weakness.

"Having a convoluted interaction between systems is almost inevitably going to lead to unintended security flaws," he said.

"I know this type of technology is developed with the best of intentions but the road to hell is paved with them."

"Just because you can connect devices en masse doesn't necessarily mean you should." -- http://www.bbc.com/news/technology-36301778


Having watched my late wife suffer from Chronic Pain for years I will refuse to be involved with any device that causes someone to experience any level of pain. Karen's Journal is required reading at Duke School of Medicine.
Karen's first-hand account of her illness gave an honest, heart-wrenching depiction of what it is like to live with debilitating pain day-to-day. -- The Derrick Newspaper, Sept 8th 2014.


The late Karen Shettler Paddock on cover of the local newspaper.


NTP Study shows Cell Phones cause brain cancer. 50 Hz causes heart tumors.

The National Toxicology Program (NTP) animal study started in 1999 released summary of their findings this week. Cell Phones cause brain cancer. 50 Hz, the power line frequency used in Europe, causes heart tumors.

The cell phone "radiofrequency radiation (RFR)" study is led by the NTP, headquartered at the National Institute of Environmental Health Sciences. The NTP has posted their report of the study’s findings: Report of Partial findings from the National Toxicology Program Carcinogenesis Studies of Cell Phone Radiofrequency Radiation in Hsd: Sprague Dawley® SD rats (Whole Body Exposure). Note the comments about the study. Some are insightful for future studies most are just the usual fear mongering.

Length report http://microwavenews.com/news-center/ntp-cancer-results that can be summed up this way:

"Importantly, the exposed rats were found to have higher rates of two types of cancers: glioma, a tumor of the glial cells in the brain, and malignant schwannoma of the heart, a very rare tumor. None of the unexposed control rats developed either type of tumor."

See also:

http://microwavenews.com

Cellphone Towers Amplify Pain in Amputees: http://www.painnewsnetwork.org/stories/2016/2/4/cellphone-towers-amplify-pain-in-amputees

Anthropogenic Radio-Frequency Electromagnetic Fields Elicit Neuropathic Pain in an Amputation Model: http://journals.plos.org/plosone/article?id=10.1371/journal.pone.0144268

Cell Phone Convenience or 21st Century Plague?
Compiled by Dr. Nick Begich and the late James Roderick.
July/26/2000
http://www.mind-fields.org/doku.php/cellphone/21stplague

If you are at all interested in this stuff a book you MUST read is The Body Electric by the late Dr Robert Becker (Not Bob Beck).

There also lots of scam devices out there that sell you something to reduce cell phone radiation then show before and after thermal graphs. I want to see a thermal graphs of an empty cell phone case held to the head. I expect it will give the same thermal graph.

If such a device worked there will be a noticeable decrees in battery life. If the 'radiation' is reduced the cell tower would get a weaker signal and the range would be less. The transmit power level of a cell phone is controlled dynamically which is why when it places with poor cell phone reception the battery drains faster due to the phone using a higher transmit power. If such a device worked it will drain the battery faster even with no connection to the battery.

A simple way to reduce exposure is use wired ear buds. They still don't bring the risk to zero. Bluetooth Handsfree headsets are not improvement. Bluetooh operates at 2.6 GHz. The same frequency as your microwave oven and WiFi. I'm not putting a tiny microwave oven next to my head...

Sunday, January 31, 2016

Visit to Large Scale Systems Museum in New Kensington Pennsylvania

Yesterday [ January 30th 2016 ] I paid a visit to the Large Scale Systems Museum (LSSM), Dave McGuire President/Curator, in New Kensington Pennsylvania.




The audio makes it sound like a very noise place, really it is not, just the microphone picking up the background cooling fans.

Currently the Museum is open only by appointment.  It is expanding to two floors soon and will then be open to the public.

Still pictures of the machines both insides and out are found on my site.

The machine labelled "ML AI" is the actual machine that The Scheme Programming Language was created on.

Directions: https://maps.here.com/directions/drive/mylocation/LSSM-large-scale-systems-museum:40.565697,-79.766243?map=40.57196,-79.76624,12,normal&fb_locale=en_US

Saturday, January 16, 2016

Maxim make the best parts that no one can ever get. Are you a "stale_member" too?

I was telling someone about the Maxim Integrated  
 MAXREFDES73# reference design a wearable, mobile galvanic skin response (GSR) system.

We were hoping to get a few of them for some parapsychology experiments. When my client asked how much it cost, I tried to log into my Maxim account, established years ago. 

All in all the experience matched that of Maxim's reputation for delivery, that is it won't. :-( 

Says it does not know my email address. When I try to register it (I've had account there for years) it says my email address is already registered and I'm a "stale_member".

Password reset generated a SQL error. So does it know my email address or not?

This is just as bad as the Maxim factory dude walking in to our meeting and saying "I don't make it out here to the Rust Belt very often...", not realizing how insulting that is to those in the area. 

They seem to make the best parts that no one can ever get... :-(  What has been your Maxim experience?

I wonder if that is why TI and Analog Device both just passed on buying them?

Maybe they are up For Sale because ignoring the markets delivery concerns has finally caught up with them?

Even this distributors in the Pittsburgh/Cleveland Market area try to get you to not buy Maxim parts from them, they don't want to hear the delivery complaints...



Sunday, October 11, 2015

Dr Richard Stallman to present at Kent State Saturday Oct. 17th


Kent, Ohio – Northeast ACM and the ACM Distinguished Speaker Program in partnership with the Kent State ComputerScience Department will present Richard Stallman Talks, taking place at Kent State University's Kiva Auditorium on Saturday October 17th 2015 featuring Dr. Richard Stallman.

NEOACM and Kent State Computer Science Department are proud to bring Dr. Richard Stallman to Kent State University for the first time. Dr. Stallman's will present his non- technical speech, A Free Digital Society, that addresses the many threats to freedom in our digital society, focusing on issues of proprietary software that controls users, digital handcuffs, massive surveillance, and censorship that undermine the foundations of democracy. Dr. Stallman is a software freedom activist and the main author of the GNU General Public License, the most widely used free software license.

Stallman developed the GNU operating system along with a number of widely used software components including the GNU compiler collection, symbolic debugger, and Emacs installed on millions of computers today. He is also the founder and president of the Free Software Foundation. Following the speech, there will be a Q & A session with Dr. Stallman and attendees will be able to purchase his books and essays.

This event is free and open to the public. Seating is limited. This event will be held in the Kiva Auditorium on Kent State Campus 800 E Summit St, Kent, Ohio.
"If in my lifetime the problem of non-free software is solved, I could perhaps relax and write software again. But I might instead try to help deal with the world's larger problems. Standing up to an evil system is exhilarating, and now I have a taste for it." - RMS
For more information, please visit http://www.neoacmchapter.org/stallman_at_kent or http://www.meetup.com/Northeast-Ohio-ACM-Chapter-Meetup
 
Copyright © 2015 Northeast Ohio ACM (A non-profit organization)

Sunday, May 10, 2015

Analog Circuit Design Three Volume Collection. 40% off until May 17th less after.

If you do Analog Circuit Design then the three volume set Analog Circuit Design from Linear Technology must be on your bookshelf.

This week Linear Tech released Volume-III of the series Analog Circuit Design, Volume 3 - Design Note Collection. Edited by Bob Dobkin and John Hamburger.

Analog Circuit Design, Volume 3, Design Note Collection is the first effort to bring Linear Technology's Design Notes into one volume. Design Notes were first published over 25 years ago, and after producing more than 500 notes, the genre is still going strong. The teaching designs in this Design Note Collection help bring new designers up to speed and give experienced designers a starting point for even more sophisticated designs. This book has two purposes: to speed designs by presenting finished examples, as well as providing a teaching resource for designers.

The Design Note Collection is a comprehensive volume of applied circuit design solutions, providing refined and practical design techniques. The book includes an extensive power management section, covering switching regulator design, linear regulator design, microprocessor power design, battery management, powering LED lighting, automotive and industrial power design. Other sections span a range of analog design topics, including data conversion, data acquisition, communications interface design, operational amplifier design techniques, filter design, wireless/RF communications and network design.

If purchased from Elsevier, enter discount code ANACIR at checkout for 30% off each of the three volumes and save 40% when you buy the three volumes together. Promotion applies to print and electronic.

Unitl May 17th 2015, Elsevier, has an other discount to save up to 40% when you buy Science and Technology eBooks.


Sunday, April 12, 2015

Richard Stallman Coming to Northeast Ohio Oct 17th

Richard Stallman of the Free Software Foundation (FSF) will be speaking Saturday October 17th 2015 at the Kiva Auditorium of Kent State University, in Northeast Ohio.


The Free Software Foundation (FSF) is a nonprofit with a worldwide mission to promote computer user freedom and to defend the rights of all free software users.
Stallman is frequently mistaken as a supporter of Open Source software, which he is not: Why Open Source misses the point of Free Software.

Stallman has been involved with the computer industry since the last 60's. A must read book for all involved in computers and embedded systems is Hackers - Heroes of the Computer Revolution by Steve Levy.
  • Richard Stallman Talk
  • Saturday, October 17, 2015
  • 1:00 PM to 3:30 PM
  • Kiva Auditorium
  • 800 E Summit Street
  • Kent, OH
Sponsored by the Northeast Ohio Chapter of the Association for Computing Machinery (ACM).

Sunday, March 1, 2015

Solving pressure and condensation build up in your Embedded System.

Have you ever had a problem with pressure build up or condensation in one of your embedded devices? Gore-Tex Vents are a good solution today, but I thought you might find The Rest Of The Story interesting. What follows is slightly edited version of a message exchange of mine from the gEDA-User mailing list.

> Dave McGuire wrote:
> > Bob Paddock wrote:
> > I'd put them in a sealed box, with a Gore-Tex Vent so that the
> > enclosure can 'breath' but not pass water.
>
> This is an interesting idea. Can Gore-Tex be found in small
> squares for this type of application, or would one be stuck
> destroying an expensive jacket to get some?

Salvation Army or Good Will would be a good place to look if you want to go the clothing route, but there is more to the story.

The whole story goes like this: Gore-Tex was invented ~1978, used in clothing as everyone knows, and didn't really find many other uses then. Jump forward to 1982. I was designing a hand held control to run some 50 Ton Coal Mining Equipment. The control was a sealed box with a membrane switch on the front. We very shortly ran into problems. Taking it down into the Mine would cause a pressure reduction that would suck the switches in, activating the switches. Having a stuck switch on a 50 Ton machine with sharp cutting bits is *bad*. Very **bad**. Also found that taking it up in a plane, as non-pressurized luggage, would deform the switch by causing it to balloon out to about four times what it should be. From flat to nice dome. You then had worthless junk, it did not recover.

I had recently read about the properties of Gore-Tex, tracked down one of the engineers in the factory and asked him if he thought it would make a good vent for such an application. He said he had no idea, but he would send me several different types of the stuff to try out. Which he did.

Putting cloth over a whole in mining equipment would last a few minutes, on on optimistic day. So a colleague of mine, Don F., came up with this labyrinth sandwich to put the Gore-Tex between.

Take two flat disks, we used thick fiberglass, each about 1/4" thick. Mill out a pocket in both disks, place them face to face, then drill a hole through both disks at one of the ends of the milled circle. Now rotate a single disk 180 degrees. Put the Gore-Tex between the disks and epoxy. If you try to stick your Sharp Pointy Coal Mining Implement into the hole you hit the fiberglass and not the Gore-Tex. The assembly was then held in the box by a screw in the four corners. Pressure problem was solved.

Went back to the fellow at Gore-Tex to get more material, which he supplied. Thought our idea was a good one and filed for the patent. So he got it and Don and I did not.

Today you can buy Gore-Tex pressure relief vent off-the-shelf. Most a screw in type plug, but they come in all kinds of sizes.


Q: Why does my FET, IGBT, SCR keep going up in smoke? A: Spot Heating

A common problem I see in message boards is that someone's circuit failed, and went up in smoke. People in the more esoteric realm's blame this on things like "Subtle Energy" overload and other such minutia. Here is the far more realistic explanation:

The very old "GE SCR Manual" goes into all of the Gorey details of what is happening inside the part, when the "Magick smoke comes out", as it is unlikely you have the Manual at hand, in a nut shell:

What lets the Magick Smoke out of IGBTS, FETS and SCRs in most cases is turn them on to slowly, causing 'Spot Heating' of the die.

Think of a FET as hundreds of thousands, possibly millions, of very small resistors all in parallel, where each one can be turned on and off individually. The 'resistors' closest to the gate turn on first, and as the gate potential spreads across the die the rest turn on. The ones farthest from the gate turn on last.

With a slow gate turn on, a few of the small resistors nearest the gate are trying to carry all of the load, which they can't do, so they burn up, but the device does not fail quite yet. The next time the device is turned on, which may be only milliseconds away depending on your switching frequency, or days away depending on the application, some more of the resistors further in burn up. When the point is reached that there is simply not enough of the 'resistors' left to carry the load is when the Magick Smoke escapes, and the part dies a catastrophic death.

This is why the parts generally run "for a while" before failing. If it fails as soon as you fire it up the first time, you either had a catastrophic short in the load, possibly shorted caps that take a bit of time to 'wake up' before they hold a charge, generally fixed with 'Soft Start', or the gate drive really sucked big time.

There needs to a be a few *amps* of current pumped in the gate of the larger parts, for short periods of time, to get the gate potential to spread across the entire die as fast as possible.

You also want to get the thing turned off as fast as possible.

If you are not familiar with the concept of Magick Smoke, this is where all electronic parts run on Magick Smoke, because once the smoke comes out of the part, it no longer runs...


Saturday, February 28, 2015

Is there a rule of thumb for estimating the cost of getting circuit boards assembled?

A reoccurring theme I see on message boards is why does it cost so much to have some electronic widgets manufactured. Here is some background for you that might help explain that.

Is there a rule of thumb for estimating the cost of getting circuit boards assembled?

In a past life I worked for a large Contract Manufacturer, Matric Limited . I don't mean this to a plug for them, but the view of the place is helpful for the discussion.

To a CM it is all about *Time*. When it comes to parts, the actually part cost is really insignificant as far as cost contribution to assembly cost goes. Most of the cost goes to the time it takes to setup and tear down.

For a broad brush overview of cost steps:

One shot fee for getting your project into the system. Someone has to enter your Bill of Materials (BOM), and schedule into the amorphous blob known as "The System". Any change that you do triggers a recalculation, that you either pay for or is amortized across your boards. Every future order you place will have a small "trigger fee" to pay for someone to enter your order.

Included in that is a fee for someone to do a time analysis of the number of operations that your project will require. A unit time value is assigned to each operation, and each operation has a cost, that is, as far as I know, calculated by Magick (All CM's use Magick for this step to my knowledge).

If you supply the parts there will be fees for entering a carrying fee per new part number into The System. They will also charge higher fees if you send them parts that require extra steps to handle such as reels of parts without leaders etc. Some cost analysis guru at GM, long ago, decided to simply have a number in The System carries a charge of $50 or so per year per part number. The accountants just love to beat up the engineering department for "we have to many parts in the warehouse". Company owner wants to keep inventory turnover high. Also cost for physically getting your parts into The System, such has putting them in the warehouse, typing in the data etc.

There will be a scrapping fee to get your stuff out of The System if you take your project someplace else.

Those Non-Recurring Engineering (NRE) fees you either pay up front, or are amortized across the number of boards. This is why the range is highly variable between different CMs. Some hide the fees, some don't.

Also, when you supply the parts the price of each part will be market up by a *minimum* of 33% (More Guru calculations). If you don't mark the price up by this amount, you lose money each time you touch the part. You are charged for the use of the warehouse space, like renting a storage unit.

Now lets say you let the CM supply the parts, in general this will get you a lower per part cost for the commodity parts. As they will be using 100,000 0.1 uF 0603 caps a day, the pick and place machine will have that loaded. So you don't have to pay for loading your reel of much smaller volume part. Also the CM will have negotiated a much better price than you got from DigiKey. The downside here is that you lose some measure of control, which can be a problem if you have to meet UL/MSHA/FDA etc. regulations.

There are extra charges for projects that involve FDA paperwork, such a per lot tracking etc. Other acronyms apply as well, UL, FCC etc.

There is a fee for having the solder paste stencil made.

Now that the NRE's are out of the way, lets build a thousand Widgets.

Someone answers the phone and enters an order into The System to build a thousand Widgets.

The System checks the warehouse to see what parts are in stock. Your order is then routed to Purchasing to get the parts that are out of stock, or routed to planning to get your order into the build Que.

When your build hits the top of the Que:

Someone pulls the parts from the warehouse, at the minimum your PCB; time.

Your bare boards are put in an oven and baked to drive out any moisture, you pay the handling and electricity; time.

Your parts are loaded on the Pick-and-Place Machine; time.

The board go from the oven to SMT Assembly; time.

Someone pulls your stencil out of the rack and puts it in the paste machine; time. Paste is applied to your board; time and paste costs.

Your board is put into the Pick-and-Place and your parts are mounted; paste, electricity and time.

Your board then goes through the IR reflow oven for soldering; electricity and time.

The boards are then cleaned; fluids and time.

Any of your parts left on the P-and-P are removed, and put back in the warehouse, when Widget #1000 comes out the end of the machine; time.

The stencil is cleaned. You pay for whatever the cleaning fluid is and time.

The stencil is put back in the rack; time.

If your boards are in a array, they are then cut apart. It is cheaper to build arrays, but it adds this cutting fee; time.

If there are parts that could not be mounted in the P-and-P Machine they are done by hand, or put through the wave solder machine, then cleaned a second time. There is a big hit in costs for anything done by hand such as connectors, transformers, cable assemblies etc. Time.

The boards then go to Quality Control for the level of inspection that you paid for. Simple visual to full functional test. Time.

Boards leave QC and go to shipping where they are put in Anti-Static bags and cardboard boxes and shipped off to you. Time. You pay the shipping one way or the other.

There could also be Added Value items such as your boards are put in an enclosure. You pay for someone to do it, right down to the number of seconds it takes to tighten down the screws.

By now you probably have gotten the idea that Time is important. When you were looking up stuff in the DigiKey catalog were you billing yourself the time it took to do it? Probably not...

The 500 piece cost for the electronic parts from Digikey is about $4.20

Did you include the Anti-Static Bag, the yellow Anti-Static Sticker that seals the bag, the solder (price of metals is going up every day), and any board cleaning fluid chemicals / deionized-water in that price of $4.20, and the time to do those items? I didn't think so...

A good CM knows the cost of every operation and will be around a long time. A new CM doesn't know his costs. Hence the wide variation in CM quotes.

Matric developed a reputation for being a high price CM, and customers would leave based on cost, rather than value. However many of them would return after a while saying "we got what we paid for", and never left again.

In the end my advice is to analyze the value of the services you are paying for, not the cost of the parts.

Tuesday, July 1, 2014

Real Time Cyber Attack Map. 'War Games' comes to life

If you wonder why your Internet has been getting slower and slower, it is due to the escalating Cyber War going on.

Norse Corporation, to showcase their technology, now lets us watch the war in real time, just like at the end of the movie War Games:

The Map shows the Attacker, the port they are attacking, and the geophysical location being attacked.

The U.S. and China keep trading places for who is the top attacker.

One of the *Attackers* I find troubling is Merck & Co. in Woodbridge New Jersey. They are attacking the SNMP Port 161, which is used to monitor network connected devices, as 19:57 EDT July 1st 2014.

There are three possibilities here:

1) Merck & Co. is actively doing the attacking. Leading to the question 'Why?'.

2) Their system is compromised, and is being used by a third party to do the attacking.

If it is compromised how do you know that their products and vaccines have not been adulterated by someone with malevolent intent, messing with production line equipment settings or worse?

In their defense let us assume they know better than to have production equipment open to the Internet, and this is some office computer than has been taken over.

3) The mapping technology is flawed.

Going back to possiblity #2:

The Sohdan Device Search Engine shows (for a fee) what devices are found on Internet, that probably should not be, or are open to the public when their owner does not know it, such as Web Cams. Are you sure your own devices are secured?.


Sunday, March 23, 2014

U.S. Aims To Give Up Control Over Internet Administration

http://www.ntia.doc.gov/press-release/2014/ntia-announces-intent-transition-key-internet-domain-name-functions


TIA Announces Intent to Transition Key Internet Domain Name Functions

Topics:

ICANN

Domain Name System

Printer-friendly version
FOR IMMEDIATE RELEASE:
March 14, 2014
News Media Contact:
NTIA, Office of Public Affairs, (202) 482-7002, press@ntia.doc.gov


WASHINGTON - To support and enhance the multistakeholder model of
Internet policymaking and governance, the U.S. Commerce Department's
National Telecommunications and Information Administration (NTIA)
today announces its intent to transition key Internet domain name
functions to the global multistakeholder community.  As the first
step, NTIA is asking the Internet Corporation for Assigned Names and
Numbers (ICANN) to convene global stakeholders to develop a proposal
to transition the current role played by NTIA in the coordination of
the Internet's domain name system (DNS).

NTIA's responsibility includes the procedural role of administering
changes to the authoritative root zone file - the database containing
the lists of names and addresses of all top-level domains - as well as
serving as the historic steward of the DNS.  NTIA currently contracts
with ICANN to carry out the Internet Assigned Numbers Authority (IANA)
functions and has a Cooperative Agreement with Verisign under which it
performs related root zone management functions.  Transitioning NTIA
out of its role marks the final phase of the privatization of the DNS
as outlined by the U.S. Government in 1997.

"The timing is right to start the transition process," said Assistant
Secretary of Commerce for Communications and Information Lawrence E.
Strickling.  "We look forward to ICANN convening stakeholders across
the global Internet community to craft an appropriate transition
plan."

ICANN is uniquely positioned, as both the current IANA functions
contractor and the global coordinator for the DNS, as the appropriate
party to convene the multistakeholder process to develop the
transition plan.  NTIA has informed ICANN that it expects that in the
development of the proposal, ICANN will work collaboratively with the
directly affected parties, including the Internet Engineering Task
Force (IETF), the Internet Architecture Board (IAB), the Internet
Society (ISOC), the Regional Internet Registries (RIRs), top level
domain name operators, VeriSign, and other interested global
stakeholders.

NTIA has communicated to ICANN that the transition proposal must have
broad community support and address the following four principles:

Support and enhance the multistakeholder model;
Maintain the security, stability, and resiliency of the Internet DNS;
Meet the needs and expectation of the global customers and partners of
the IANA services; and,
Maintain the openness of the Internet.

Consistent with the clear policy expressed in bipartisan resolutions
of the U.S. Senate and House of Representatives (S.Con.Res.50 and
H.Con.Res.127), which affirmed the United States support for the
multistakeholder model of Internet governance, NTIA will not accept a
proposal that replaces the NTIA role with a government-led or an
inter-governmental organization solution.

From the inception of ICANN, the U.S. Government and Internet
stakeholders envisioned that the U.S. role in the IANA functions would
be temporary.  The Commerce Department's June 10, 1998 Statement of
Policy stated that the U.S. Government "is committed to a transition
that will allow the private sector to take leadership for DNS
management."  ICANN as an organization has matured and taken steps in
recent years to improve its accountability and transparency and its
technical competence.  At the same time, international support
continues to grow for the multistakeholder model of Internet
governance as evidenced by the continued success of the Internet
Governance Forum and the resilient stewardship of the various Internet
institutions.

While stakeholders work through the ICANN-convened process to develop
a transition proposal, NTIA's current role will remain unchanged.  The
current IANA functions contract expires September 30, 2015.

For further information see: IANA Functions and Related Root Zone
Management Transition Questions and Answers

About NTIA

NTIA is the Executive Branch agency that advises the President on
telecommunications and information policy issues. NTIA's programs and
policymaking focus largely on expanding broadband Internet access and
adoption in America, expanding the use of spectrum by all users, and
ensuring that the Internet remains an engine for continued innovation
and economic growth. To find out more about NTIA, visit
http://www.ntia.doc.gov.

While the US Government clearly has issues, do you think other countries will be as supportive of any open system like Internet is today? What will happen to the Internet if control of the root domains end up in the hands of the UN or an organization where each country gets a single vote on governance?

What is truly needed is a decentralized Domain Name System. Namecoine is being considered as one alternative. Are there others?


Tech Companies Say Better to Import More Workers Than Retrain Experienced Ones

"WASHINGTON, March 19,2014 /PRNewswire-USNewswire/ -- Addressing a media conference call today, Scott Corley, executive director of Compete America, asserted that the large high-tech companies he represents would rather bring in more H-1B temporary workers than retrain experienced American employees."

...

Corley replied: "If it could be done as easily, there would be less value in the worker. ... You're saying it's easy to be trained into these fields, but if that were true, there would be no value; they wouldn't be high-paying jobs. You would be able to find them anywhere."

"Mr. Corley made clear companies would rather use the H-1B visa to hire younger, cheaper temporary workers," IEEE-USA President Gary Blank said.

...

-- http://m.prnewswire.com/news-releases/tech-companies-say-better-to-import-more-workers-than-retrain-experienced-ones-says-ieee-usa-251079061.html.

See also You'd Rather Import Than Retrain. Why? by Carolyn Mathas.

People wonder why the younger generation has no interest in getting in to the STEM fields. They are not stupid, they read garbage like the above just like you and I can. Why pursue such an education when the jobs only go to the cheapest people?


Saturday, February 15, 2014

Does 'Drop in replacement' strike fear into your Soul? It should...

I have been using IrDA (Infrared Optical transceivers) for several years for setting parameters and doing software updates in my designs. Takes far less space and power that WiFi or Bluetooth.

There was once many people making IrDA transceivers, back when they were used in Cell Phones before the era of Bluetooth, now there are only a couple of manufactures left. Once I had three sources for a footprint compatible part with the HP3003 that I originally started with. Over the years the only remaining footprint compatible part was the Vishay TFDU4300.

Sadly the day came when even the 4300 was discontinued, however I was assured that I was not going to have to do a new board spin, "you can drop our new TFDU4301 right in". While true that it was footprint compatible, it was not software compatible. The 4300 would not receive its own output and would drive its Rx line high during transmit. The 4301 echos the transmitted data, meaning all of the bootloaders had to be updated to turn off the receiver when transmitting. Annoying, but at least that was documented.

What was not documented is shown in the scope captures below. The first one shows the discontinued 4300 and the second shows the new 'drop in compatible replacement'. Does it look compatible to you?


Sadly this problem was discovered while I was far away trying to get my wife help with Intracranial Hypotension, more commonly known as a Cerebrospinal Fluid (CSF) Leaks, to stop her excruciating headache resulted from cerebrospinal fluid leakage. I made the mistake of putting my job first and we came home to Pittsburgh, when we should have stayed at Duke in North Carolina. This is one of the small events that accumulated to result in my wife's suicide.

Now does 'drop in replacement' strike fear into your Soul too?


Thursday, January 2, 2014

Internet of Things (IoT) possibly Carcinogenic to Humans

An obscure part of the World Health Organization, the International Agency for Research of Cancer (IARC), published an even more obscure paper: IARC Classifies Radiofrequency [RF] Electromagnetic Fields as Possibly Carcinogenic to humans in 2011.

I bring this up as Epidemiology just published (January 2014 - Volume 25 - Issue 1 - p 23-27;doi: 10.1097/EDE.0000000000000028) Commentary: Mobile Phones and Cancer: Next Steps After the 2011 IARC Review. I've covered this area before so I'll refer you there rather than repeat it here. See also Something Is Rotten in Denmark: Danish Cancer Society Plays Games with Brain Cancer Rates and IARC Monographs on the Evaluation of Carcinogenic Risks to Humans.

Something else bothers me about the push for the (unneeded?) Internet of Things (IoT). Lots of places talk of or show how to power the low power sensors and such from 'ambient' RF power taken from the environment, such as a local TV or Radio Station. At what point does the source transmitter get overloaded with the million(s) of IoT devices drawing power from it? What do the owners of these transmitters think of this? Isn't this technically illegal under the same laws that prevent farmers from drawing power from the power company via inductive coupling to their mile(s) long electric fence wires?

Ponder this, as related to many receivers drawing from a single transmitter: If I strike a tuning fork in a room of a 1000 identical tuning forks what happens? Leave your answer in the comments.


Hacker's Delight 2nd Edition

I covered the book Hacker's Delight (1st Edition) in the past. So wanted to mention that there is now a expanded second edition.

This book is about obscure high efficiency ways to write code. If your looking for ways to do things you shouldn't, this is not the book you are looking for.

  • A new chapter on cyclic redundancy checking (CRC), including routines for the commonly used CRC-32 code
  • A new chapter on error correcting codes (ECC), including routines for the Hamming code
  • More coverage of integer division by constants, including methods using only shifts and adds
  • Computing remainders without computing a quotient
  • More coverage of population count and counting leading zeros
  • Array population count
  • New algorithms for compress and expand
  • An Least Recently Used [LRU; Cache] algorithm
  • Floating-point to/from integer conversions
  • Approximate floating-point reciprocal square root routine
  • A gallery of graphs of discrete functions
  • Now with exercises and answers

Sunday, October 6, 2013

Won 3rd place Dare-to-Dream Medtech Design Challenge

I won third place in Medical Device + Diagnostic Industry magazine's Dare-to-Dream Medtech Design Challenge.


MD+DI is a magazine written exclusively for original equipment manufacturers of medical devices and in vitro diagnostic products.
A month ago, the editors of MD+DI created a medtech design contest, where we challenged you to design your dream device under the assumption that real-world challenges were non-existent.


3 Dream Devices Take Top Honors in Medtech Design Contest

In August, the editors of MD+DI asked you, the medtech community, to put on your creative hats and dream up a device that would tackle health-care problems both big and small.
You responded, submitting an array of innovative medical device concepts that addressed a broad spectrum of issues. The editors of MD+DI reviewed and debated the merits of each submission, and narrowed the field to 10 finalists. ...
Rounding out the winners' circle in third place is the Intracranial Cerebrospinal Fluid Pressure Regulator. The entry, submitted by Bob Paddock, was inspired by a personal experience; his wife committed suicide after an excruciating headache that resulted from cerebrospinal fluid leakage.
"The inspiration for this dream device obviously came from a very personal place," said Jamie Hartford, managing editor of MD+DI. "The Intracranial Cerebrospinal Fluid Pressure Regulator is a novel improvement over the standard of care for intracranial hypotension caused by cerebrospinal fluid leaks, a condition that can cause devastating headaches. I like that it uses wireless power transfer, which is really the next step for implantable devices."
Thank you for voting on my design. Hopefully it will get the attention of some medical manufacture...

See 1st and 2nd place winners here: http://www.mddionline.com/article/3-winners-announced-dare-dream-medtech-design-challenge