Hi John,
That is really poor engineering. The least they should have done is the
electronic equivalent of a dead-man switch. Don't know if they still
have them but in Europe the train engineer had to push a button
regularly. If he or she didn't the train would stop. On BART they would
have needed something like that for the controller. If a certain pulse
that would have been generated by the firmware failed to appear again
within x msec the train should have automatically stopped by means of
uncommitted hardware. It's the basic watchdog concept.
Did they try to stiff you for the damages caused?
No, but they assumed it was the controller's fault until we (entirely
under the table) installed the blackbox recorder at a customer site
and caught the 3000C command red-handed. Since then, I've added a
hightemp shutdown limit that can only be set from the front panel of
our box, not by the system software. Part of the problem was that our
box had to work with an abysmal historical serial comm protocol that
was disaster waiting to happen.
Don't know the ratio of friends/enemies created by that little
exercize.
John
