Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A400M Airbus Flier crashed because of software issues

translate.google.com

Post reply on HN
Print view View original

91–100 of 129 posts

Re: A400M Airbus Flier crashed because of software issues

#91

Post by inetsee »

I worked on software for the C-130J military cargo plane. It was before my time, but an earlier model aircraft crashed during a test flight. The crash occurred shortly after take off, and the entire crew was lost.

There is a critical time period during a take off when the aircraft is at maximum risk. If an engine fails before rotation (i.e. before the wheels leave the ground) an alert crew can stand on the brakes and use thrust reversers. The aircraft may get dinged up, but there is a reasonable chance the crew (and passengers) will survive.

If there is an engine failure after rotation but before the aircraft has gained sufficient altitude, unless there's a big, flat field next to the runway a crash is almost inevitable.

When an aircraft turns, it will lose altitude unless the crew compensates by adding power. An aircraft without power and sufficient altitude cannot make the turns necessary to go all the way around to land on the runway they just left.

Re: A400M Airbus Flier crashed because of software issues

#92

Post by fleitz »

randomname2 wrote: post #77
rkangel wrote: post #23

Earlier quoted context omitted.

Then stick with a news agency rather than journalists. The information from somewhere like Reuters is carefully presented as pure content, no opinion, and probably has a greater chance of being true.

This is laughably false. While staying away from outright lying, Reuters very often adds their own spin to their reporting.

Especially when it's their own journalists getting taken out in 'classified' videos.

Re: A400M Airbus Flier crashed because of software issues

#93

Post by jcadam »

castell wrote: post #42
alandarev wrote: post #18

Software contractor for Airbus and Rolls-royce here. All safety critical software (every piece of code ran on-board is safety critical the least) in aerospace needs to pass the DO-178 standard [1]. That is far more serious than standard unit tests you are used to in node.js applications. Generally speaking, to develop a piece of code under that standard it takes 20% of time to write the code, and 80% to testing, and…

Which programming language is commonly used there? Ada, C, C++, JOVIAL, Asm?

Really, you'd want to use Ada for something like this (The language has survived specifically because it's managed to carve out a niche for itself in aerospace).

I once worked on satellite systems using Ada95 and Ada2005 (Ada is definitely not dead). The language is a pain to use but is impressive in that it catches more crap at compile-time than anything else I've seen.

Re: A400M Airbus Flier crashed because of software issues

#95

Post by sleeping_pills »

madez wrote: post #76
sleeping_pills wrote: post #59

Earlier quoted context omitted.

While I agree with your statement that open sourcing code can help with improving it's quality, how exactly do you envision (paraphrasing) "hackers contributing pull requests" to code that controls engines on an airplane? Here you have an extremely specialized codebase which can perhaps be understood by a tiny group of professionals and it can actually be tested by an absolutely vanishingly small group of individuals…

You sound exactly like my current boss, who says that Linux is just a hobby project that you can put no trust in. I mean, who would fix problems if it's just a hobby? And if it's open, it must be a hobby. Surely, that can't possibly work!

Did you actually read my post? If yes, can you seriously not see the difference between writing/testing an OS and writing/testing the software that controls jet engines?

Open sourcing something like Linux works very well _precisely_ because it has a very large audience and is (relatively) approachable by hobbyists too.

On the other hand, aerospace engineering and software is narrowly specialized with a (relatively) small group of experts and code used in commercial/military aircraft is anything but approachable to hobbyists.

Then there is the fact that unit testing this kind of code requires engineering knowledge of the specific hardware involved (e.g. not just any jet engine, but one very specific model). Finally, let us not even mention the huge pink elephant in the room, namely that the absolute and vast majority of "hackers" does not have access to jet engines used in commercial (or military) airplanes and even fewer have the ability to conduct test flights.

Re: A400M Airbus Flier crashed because of software issues

#96

Post by progman »

lambdaelite wrote: post #89
tormeh wrote: post #86

Earlier quoted context omitted.

Using C/C++ on these projects is idiotic. If Airbus used C/C++ then they deserve all the financial loss in the world. They have blood on their hands.

Keep in mind they don't use C/C++. They use C/C++ with a coding standard (like MISRA), static analysis tools, validated compilers, development processes incorporating change control, documentation, verification and validation, etc. What alternative are you suggesting?

I know that Ada compilers are 100% verified correct but is there really any validated C++ compiler? Which one?

AFAIK (partial) assurance in C/C++ can only be handled by additional testing tools, Frama-C for instance.

I agree that C/C++ should not be used for security applications. Ada is a much better choice because it was designed for security.

Re: A400M Airbus Flier crashed because of software issues

#97

Post by progman »

jcadam wrote: post #93
castell wrote: post #42

Earlier quoted context omitted.

Which programming language is commonly used there? Ada, C, C++, JOVIAL, Asm?

Really, you'd want to use Ada for something like this (The language has survived specifically because it's managed to carve out a niche for itself in aerospace). I once worked on satellite systems using Ada95 and Ada2005 (Ada is definitely not dead). The language is a pain to use but is impressive in that it catches more crap at compile-time than anything else I've seen.

> Ada is definitely not dead

True. More information: http://www.ada2012.org

Re: A400M Airbus Flier crashed because of software issues

#98

Post by gvr »

jonnycowboy wrote: post #65
alandarev wrote: post #18

Software contractor for Airbus and Rolls-royce here. All safety critical software (every piece of code ran on-board is safety critical the least) in aerospace needs to pass the DO-178 standard [1]. That is far more serious than standard unit tests you are used to in node.js applications. Generally speaking, to develop a piece of code under that standard it takes 20% of time to write the code, and 80% to testing, and…

I also work in aerospace software. Following DO178 certainly does not guarantee that there will be no software bugs. The point of DO178 is to follow a process that will _minimize_ the number of bugs by having adequate peer review processes throughout the requirement definition, coding, integration phases, in addition to the testing you mention above. Testing DO178 only tests that the code follows the requirements. If…

That is certainly one source for error. There are many. Another is that testing does not give you exhaustive coverage of the state space just because each branch of the code is visited.

The standard does mention "formal verification/methods/proof" but to my knowledge it's rarely been used extensively.

Re: A400M Airbus Flier crashed because of software issues

#99

Post by sokoloff »

inetsee wrote: post #91

I worked on software for the C-130J military cargo plane. It was before my time, but an earlier model aircraft crashed during a test flight. The crash occurred shortly after take off, and the entire crew was lost. There is a critical time period during a take off when the aircraft is at maximum risk. If an engine fails before rotation (i.e. before the wheels leave the ground) an alert crew can stand on the brakes and…

Your post is substantially correct, with a clarification on rotation speed(Vr) vs takeoff decision speed (V1).

There are three relevant speeds for large aircraft. (I'm going to generalize very slightly to keep this short and readable.)

V1, Vr, V2.

V1 is the takeoff decision speed. An engine failure recognized before reaching V1 is handled by aborting the takeoff. An engine failure recognized after reaching V1 is handled by continuing the takeoff. At the V1 callout, the pilot flying removes their hands from the top of the throttles (as a physical reminder that aborting/rejecting the takeoff(RTO) is not happening for a simple engine failure).

Vr is the rotation speed, where the nose wheel is lifted from the ground.

V2 is the speed at which the airplane will climb safely with one engine INOP.

In most cases, V1 is the lowest speed, meaning there are cases (between V1 and Vr) where an engine out with the nosewheel on the ground results in continued acceleration, then rotation, and flight.

It's a checkride bust to RTO above V1 for a simple engine failure.

Re: A400M Airbus Flier crashed because of software issues

#100

Post by lambdaelite »

progman wrote: post #96
lambdaelite wrote: post #89

Earlier quoted context omitted.

Keep in mind they don't use C/C++. They use C/C++ with a coding standard (like MISRA), static analysis tools, validated compilers, development processes incorporating change control, documentation, verification and validation, etc. What alternative are you suggesting?

I know that Ada compilers are 100% verified correct but is there really any validated C++ compiler? Which one? AFAIK (partial) assurance in C/C++ can only be handled by additional testing tools, Frama-C for instance. I agree that C/C++ should not be used for security applications. Ada is a much better choice because it was designed for security.

Not sure if I'm understanding your question correctly, but Wind River claims their Diab compiler is validated by TÜV NORD and is has been used for stuff up to SIL4.

In fact, they (http://windriver.com/products/product-overviews/PO_Diab_Comp...) say:

  Diab Compiler has been a reliable code generation tool for
  avionics products certified for DO-178B, products for the
  nuclear market certified to IEC 60880, railway applications
  certified to EN 50128, and industrial products certified
  to IEC 61508, and is now qualified for use in automotive
  applications certified to ISO 26262.
Ada does have some built-in advantages, but I think my point still stands: the language is a small part of the entire SDLC, and I don't think it's the most important part.
Post reply on HN