5 ms·

Connecting entertainment systems to flight control sounds very wrong. Connecting entertainment systems to flight management would be common; it should be one-wa

by tjr 7y ago

Connecting entertainment systems to flight control sounds very wrong. Connecting entertainment systems to flight management would be common; it should be one-way communication (entertainment can only read FMS data, not send any), for the purpose of driving the moving map displays for passengers.

toomuchtodo 7y ago
> it should be one-way communication (entertainment can only read FMS data, not send any), for the purpose of driving the moving map displays for passengers. Would you agree that this logical boundary should be physically enforced? Such as an opto-isolator?
- amluto 7y ago
  No fancy circuitry is needed. Just use one fiber. I suspect that 100BASE-T can pull this off with one pair and some hackery. RS232 should work work only one direction connected.
  - deleted 7y ago
    [deleted]
- debatem1 7y ago
  Used to be done with a literal diode.
  - kps 7y ago
    Well, an optoisolator is a literal diode plus a literal transistor. I'm okay with that much hi tech.
  - basilgohar 7y ago
    The funny thing is that LEDs (granted, not all types of diodes) can be used to read data as well as transmit it. Videos of such interfaces can be found on YouTube. So, they are not as one-way as some folks may think. https://youtu.be/aLP-OF4nesY https://youtu.be/aLP-OF4nesY
    - temac 7y ago
      Well it can not only be a LED that is supposed to be one-way, but the whole circuitry driving it. Likewise for the receptor. With some appropriate review of the physical design, you can have a reasonable expectation that the comm will be limited to one-way, with no way for arbitrary SW to modify the direction.
    - debatem1 7y ago
      Usually wasn't an LED. Just a normal diode.
- henryfjordan 7y ago
  > Boeing maintains that other security barriers in the 787's network architecture would make that progression impossible. They probably do something to that effect
  - toomuchtodo 7y ago
    The longer I'm alive the more firmly I commit to never assume anything. I have seen things. Terrible things.
    - p_l 7y ago
      Connectivity between zones is something FAA actually caught in 787 when it was still being built and forced a redesign.
  - snickerbockers 7y ago
    "security barrier" is a vague, meaningless phrase that they don't define. There shouldn't be any connection at all between flight systems and the in-flight entertainment.
- tjr 7y ago
  Yes.
- mjevans 7y ago
  There should actually be three distinct "air-gaped" networks (or at least classifications of network). Secure: The network that connects and controls the airplane. Absolutely only essential things allowed on, and if possible isolated using mathematically proven secure vlan/isolation techniques. "Employee": pilots, crew, etc. This is more just a distinct network for corporate operations security. "Customer": Still try to keep this one secure so that virus and just don't spread, but this is the 'DMZ' area. Communication from the secure network should be outbound only, and might best be done over a fixed rate serial data connection of some sort. The modern version might be to configure a point to point network link on a CDMA based system and just disconnect the secure side's RX path entirely. Then you just export the data blind via UDP with like 10X redundancy.
  - stefan_ 7y ago
    Most Boeing planes (though not the 787 discussed here) don't use fly-by-wire, so you could argue that the most essential control plane is perfectly isolated by virtue of not having any sort of network at all, just hydraulics into the cabin.
    - blunte 7y ago
      But wasn't the 737-max issue that a software system was forcing an elevator change to pitch the nose down? That sounds pretty fly-by-wire (even if hydraulics are involved).
      - p_l 7y ago
        You could say that the problem was lack of fly-by-wire - if 737-MAX had FBW, the necessary corrections would be bundled as part of flight envelope protection, and that tends to work pretty well and the required checks on FBW systems would catch stuff like "only one AoA sensor used". Instead we got MCAS which was messing with autotrim signals and escaped scrutiny.
- yc-kraln 7y ago
  This sounds like a good idea, until you realize that the head unit is typically the thing in the car with the most computing power (think AI workloads as well as a GPU and multiple ARM cores) and the thing in the car with the network connection. A trivial use case which requires write access to the CAN bus is the navigation system informing cruise control of an upcoming hill. Equally trivial would be the seat position memory or profiles being applied through the main touchscreen. (I work for a company that is developing infotainment systmes)
usrusr 7y ago
The moving map could easily be fed from a separated consumer grade GPS. Same for all other metrics that the median passenger would care about (height, speed over ground), except for the ever-impressive outside temperature.
- tjr 7y ago
  Outside temperature is pretty impressive indeed. The map also shows projected flight plan and ETA, which would not come purely from GPS.
  - rootusrootus 7y ago
    Most/all international flights I've been on are really terrible at providing an accurate flight plan or ETA to the passengers via the entertainment system. I would not be surprised if it is already a manual update done when convenient by a member of the flight crew.
    - tjr 7y ago
      Could be! I can safely say that not all such entertainment systems work that way, but I reckon it's possible that some do.
    - dx034 7y ago
      They tend to use what's programmed in the FMS. Pilots will have the cleared route in there, even if they already know that they'll probably get several short cuts along the way.
  - goodcanadian 7y ago
    I have never seen one that showed a flight plan. They only had a straight-line (well, a great circle route) to the destination. ETA was pretty clearly straight-line distance divided by (average?) speed.
- p_l 7y ago
  Data diodes are things that exist

by tjr 7y ago

toomuchtodo 7y ago

> it should be one-way communication (entertainment can only read FMS data, not send any), for the purpose of driving the moving map displays for passengers. Would you agree that this logical boundary should be physically enforced? Such as an opto-isolator?

amluto 7y ago
No fancy circuitry is needed. Just use one fiber. I suspect that 100BASE-T can pull this off with one pair and some hackery. RS232 should work work only one direction connected.
- deleted 7y ago
  [deleted]
debatem1 7y ago
Used to be done with a literal diode.
- kps 7y ago
  Well, an optoisolator is a literal diode plus a literal transistor. I'm okay with that much hi tech.
- basilgohar 7y ago
  The funny thing is that LEDs (granted, not all types of diodes) can be used to read data as well as transmit it. Videos of such interfaces can be found on YouTube. So, they are not as one-way as some folks may think. https://youtu.be/aLP-OF4nesY https://youtu.be/aLP-OF4nesY
  - temac 7y ago
    Well it can not only be a LED that is supposed to be one-way, but the whole circuitry driving it. Likewise for the receptor. With some appropriate review of the physical design, you can have a reasonable expectation that the comm will be limited to one-way, with no way for arbitrary SW to modify the direction.
  - debatem1 7y ago
    Usually wasn't an LED. Just a normal diode.
henryfjordan 7y ago
> Boeing maintains that other security barriers in the 787's network architecture would make that progression impossible. They probably do something to that effect
- toomuchtodo 7y ago
  The longer I'm alive the more firmly I commit to never assume anything. I have seen things. Terrible things.
  - p_l 7y ago
    Connectivity between zones is something FAA actually caught in 787 when it was still being built and forced a redesign.
- snickerbockers 7y ago
  "security barrier" is a vague, meaningless phrase that they don't define. There shouldn't be any connection at all between flight systems and the in-flight entertainment.
tjr 7y ago
Yes.
mjevans 7y ago
There should actually be three distinct "air-gaped" networks (or at least classifications of network). Secure: The network that connects and controls the airplane. Absolutely only essential things allowed on, and if possible isolated using mathematically proven secure vlan/isolation techniques. "Employee": pilots, crew, etc. This is more just a distinct network for corporate operations security. "Customer": Still try to keep this one secure so that virus and just don't spread, but this is the 'DMZ' area. Communication from the secure network should be outbound only, and might best be done over a fixed rate serial data connection of some sort. The modern version might be to configure a point to point network link on a CDMA based system and just disconnect the secure side's RX path entirely. Then you just export the data blind via UDP with like 10X redundancy.
- stefan_ 7y ago
  Most Boeing planes (though not the 787 discussed here) don't use fly-by-wire, so you could argue that the most essential control plane is perfectly isolated by virtue of not having any sort of network at all, just hydraulics into the cabin.
  - blunte 7y ago
    But wasn't the 737-max issue that a software system was forcing an elevator change to pitch the nose down? That sounds pretty fly-by-wire (even if hydraulics are involved).
    - p_l 7y ago
      You could say that the problem was lack of fly-by-wire - if 737-MAX had FBW, the necessary corrections would be bundled as part of flight envelope protection, and that tends to work pretty well and the required checks on FBW systems would catch stuff like "only one AoA sensor used". Instead we got MCAS which was messing with autotrim signals and escaped scrutiny.
yc-kraln 7y ago
This sounds like a good idea, until you realize that the head unit is typically the thing in the car with the most computing power (think AI workloads as well as a GPU and multiple ARM cores) and the thing in the car with the network connection. A trivial use case which requires write access to the CAN bus is the navigation system informing cruise control of an upcoming hill. Equally trivial would be the seat position memory or profiles being applied through the main touchscreen. (I work for a company that is developing infotainment systmes)

usrusr 7y ago

The moving map could easily be fed from a separated consumer grade GPS. Same for all other metrics that the median passenger would care about (height, speed over ground), except for the ever-impressive outside temperature.

tjr 7y ago
Outside temperature is pretty impressive indeed. The map also shows projected flight plan and ETA, which would not come purely from GPS.
- rootusrootus 7y ago
  Most/all international flights I've been on are really terrible at providing an accurate flight plan or ETA to the passengers via the entertainment system. I would not be surprised if it is already a manual update done when convenient by a member of the flight crew.
  - tjr 7y ago
    Could be! I can safely say that not all such entertainment systems work that way, but I reckon it's possible that some do.
  - dx034 7y ago
    They tend to use what's programmed in the FMS. Pilots will have the cleared route in there, even if they already know that they'll probably get several short cuts along the way.
- goodcanadian 7y ago
  I have never seen one that showed a flight plan. They only had a straight-line (well, a great circle route) to the destination. ETA was pretty clearly straight-line distance divided by (average?) speed.
p_l 7y ago
Data diodes are things that exist