Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

UK air traffic control meltdown

jameshaydon.github.io

Post reply on HN
Print view View original

331–340 of 459 posts

Re: UK air traffic control meltdown

#331

Post by nightpool »

WalterBright wrote: post #329
wavemode wrote: post #327

Earlier quoted context omitted.

First thought that came to my mind as well when I read it. This failover system seems to be more designed to mitigate hardware failures than software bugs.

I also understand that it is impractical to implement the ATC system software twice using different algorithms. The software at least checked for an illogical state and exited, which was the right thing to do. A fix I would consider is to have the inputs more thoroughly checked for correctness before passing them on to the ATC system.

not stronger isolation between different flight plans? it seems "obvious" to me that if one flight plan is causing a bug in the handling logic, the system should be able to recover by continuing with the next flight plan and flagging the error to operators to impact that flight only

Re: UK air traffic control meltdown

#332

Post by WalterBright »

nightpool wrote: post #331
WalterBright wrote: post #329

Earlier quoted context omitted.

I also understand that it is impractical to implement the ATC system software twice using different algorithms. The software at least checked for an illogical state and exited, which was the right thing to do. A fix I would consider is to have the inputs more thoroughly checked for correctness before passing them on to the ATC system.

not stronger isolation between different flight plans? it seems "obvious" to me that if one flight plan is causing a bug in the handling logic, the system should be able to recover by continuing with the next flight plan and flagging the error to operators to impact that flight only

"unexpected errors" are not necessarily problems with the flight plans. They could be anything.

Re: UK air traffic control meltdown

#333

Post by garyfirestorm »

> Safety critical software systems are designed to always fail safely. This means that in the event they cannot proceed in a demonstrably safe manner, they will move into a state that requires manual intervention.

unrelated - this instantly caused me to think about tesla autopilot crashes that have been reported with emergency vehicles

Re: UK air traffic control meltdown

#334

Post by sam0x17 »

f1shy wrote: post #174
sam0x17 wrote: post #163

Earlier quoted context omitted.

Why on earth do they not have GUIDs for these navigation points if the names are not globally unique and inter-region routes are commonplace?

The names have to be entered manually by pilots, if e.g. they change the route. They have to be transmitted over the air by humans. So they must be short ans simple.

Sounds like we should have globally unique human-enterable identifiers governed by an ISO..

Re: UK air traffic control meltdown

#335

Post by dhx »

WalterBright wrote: post #322

> the backup system applied the same logic to the flight plan with the same result Oops. In software, the backup system should use different logic. When I worked at Boeing on the 757 stab trim system, there were two avionics computers attached to the wires to activate the trim. The attachment was through a comparator, that would shut off the authority of both boxes if they didn't agree. The boxes were designed with:…

This would have been a 2oo2 system where the pilot becomes the backup. 2oo2 systems are not highly available.

Air traffic control systems should at least be 2oo3[1] (3 systems independently developed of which 2 must concur at any given time) so that a failure of one system would still allow the other two to continue operation without impacting availability of the aviation industry.

Human backup is not possible because of human resourcing and complexity. ATC systems would need to be available to provide separation under IFR[2] and CVFR[3] conditions.

[1] https://en.wikipedia.org/wiki/Triple_modular_redundancy

[2] https://en.wikipedia.org/wiki/Instrument_flight_rules#Separa...

[3] https://en.wikipedia.org/wiki/Visual_flight_rules#Controlled...

Re: UK air traffic control meltdown

#336

Post by borissk »

WalterBright wrote: post #322

> the backup system applied the same logic to the flight plan with the same result Oops. In software, the backup system should use different logic. When I worked at Boeing on the 757 stab trim system, there were two avionics computers attached to the wires to activate the trim. The attachment was through a comparator, that would shut off the authority of both boxes if they didn't agree. The boxes were designed with:…

Different teams often make the same mistake. The system you describe is not perfect, but makes sense.

Re: UK air traffic control meltdown

#337

Post by vachina »

worik wrote: post #198

I heard in the news that this was caused by a "bad flight plan". It is clear, even without any more information than that, it was a software failure (bad flight plan?) It will be interesting to see if Frequentis has to pay a price for causing this

I think Frequentis will actually be paid more to “add feature to make the system more robust” and a bump in support schedules.

Re: UK air traffic control meltdown

#338

Post by amiga386 »

darkclouds wrote: post #319
amiga386 wrote: post #134

Earlier quoted context omitted.

> so why the 4 hour lead time To answer your question without conspiracy drivel, let's look up CAP 694: The UK Flight Planning Guide [0] Chapter 1 > 6.1 The general ICAO requirement is that FPLs should be filed on the ground at least 60 minutes before clearance to start-up or taxi is requested. The "Estimated Off Block Time" (EOBT) is used as the planned departure time in flight planning, not the planned airborne tim…

So on point 3 then, why do countries, turn people away at the destination and not before take off, if their visa or passport is not in order? Are their systems not joined up, or does the state just like making examples of peoples once on the destination country? I can watch this stuff happening to people at airport border controls on TV all the time so which is it? Their systems are not joined up or they just like ma…

Most countries do not have prescreening or data sharing treaties. Even in the case where two countries do have it, not all entrance criteria can be determined by electronic records. Countries reserve the right to check the traveller themselves before they permit entry.

Here's a list of common reasons for the UK to refuse entry on arrival: https://www.gov.uk/government/publications/suitability-refus...

Some examples:

* Your valid travel document (as communicated digitally) turns out to be invalid when you actually present it

* You got a tourist visa, not a work visa, so why do you have work tools in your luggage?

* You turn up infected with Ebola

Re: UK air traffic control meltdown

#339

Post by Pxtl »

tjohns wrote: post #274
epanchin wrote: post #215

Earlier quoted context omitted.

What three words would be a better solution than a guid, as transmittable over radio.

That would actually be pretty bad. As mentioned, W3W is propritary, requires an online connection, and has homonyms. On top of that, you need to enter these waypoints into your aircraft's navigation system - sometimes one letter at a time using a rotary dial. These navigation systems will stay in service for decades. Aviation already uses phonetically pronounceable waypoint names. Typically 5 characters long for RNAV…

If only there was a globally unique set of short two-letter names for every country that could be used as prefixes to enforce uniqueness while still allowing every country to manage their own internal waypoint list.

If only.

Re: UK air traffic control meltdown

#340

Post by jameshh »

j_mo wrote: post #305
lbriner wrote: post #76

I seem to remember another problem at NATS which had the same effect. Primary fell over so they switched over to a secondary that fell over for the exact same reason. It seems like you should only failover if you know the problem is with the primary and not with the software itself. Failing over "just because" just reinforces the idea that they didn't have enough information exposed to really know what to do. The bit…

No validation, anddd this point from the article stood out to me: --- The programming style is very imperative. Furthermore, the description sounds like the procedure is working directly on the textual representation of the flight plan, rather than a data structure parsed from the text file. This would be quite worrying, but it might also just be how it is explained. --- Given that description, I'd be surprised if it…

> Bearing in mind this is likely decades old C code that can't be rewritten or replaced because the entirety of the UK's aviation runs on it.

It's new code, from 2018 :) Quote from the report:

> An FPRSA sub-system has existed in NATS for many years and in 2018 the previous FPRSA sub- system was replaced with new hardware and software manufactured by Frequentis AG, one of the leading global ATC System providers.

Post reply on HN