5 ms·
One of my favourites that I ever heard about was from a friend of mine who used to work on safety-critical systems in defense applications. He told me fighter
by seanhunter 3y ago
One of my favourites that I ever heard about was from a friend of mine who used to work on safety-critical systems in defense applications. He told me fighter jets have a safety system that disables the weapons systems if a (weight) load is detected on the landing gear so that if the plane is on the ground and the pilot bumps the wrong button they don't accidentally blow up their own airbase[1]. So anyway when the Eurofighter Typhoon did its first live weapons test the weapons failed to launch. When they did the RCA they found something like[2]
bool check_the_landing_gear_before_shootyshoot(double weight_from_sensor, double threshold) {
//FIXME: Remember to implement this before we go live
return false
}
So when the pilot pressed the button the function disabled the weapons as if the plane had been on the ground. Because the "correctness" checks were against the Z spec and this function didn't have a unit test because it was deemed too trivial, the problem wasn't found before launch, so this cost several millions to redeploy the (one-line) fix to actually check the weight from the sensor was less than the threshold.
[1] Yes this means that scene from the cheesy action movie (can't remember which one) where Arnold Schwartzenegger finds himself on the ground in the cockpit of a russian plane and proceeds to blow up all the badguys while on the ground couldn't happen in real life.
[2] Not the actual code which was in some weird version of ADA apparently.
- MisterTea 3y ago> weird version of ADA Spark: https://en.wikipedia.org/wiki/SPARK_(programming_language) https://en.wikipedia.org/wiki/SPARK_(programming_language) And it's Ada not ADA which makes me think of the Americans with Disabilities Act.
- seanhunter 3y agoAah thank you on both counts yes. One interesting feature he told me about is they wrote a "reverse compiler" that would take Spark code and turn it into the associated formal (Z) spec so they could compare that to the actual Z spec to prove they were the same. Kind of nifty.
- WalterBright 3y agoSounds like Tranfor which would convert FORTRAN code to flowcharts, because government contracts required flowcharts.
- yafbum 3y ago> this cost several millions to redeploy the (one-line) fix to actually check the weight from the sensor was less than the threshold Well maybe this is the other, compounding problem. Engineering complex machines with such a high cost of bugfix deployment seems like a big issue. It's funny that as an industry we now know how to safely deploy software updates to hundreds of millions of phones, with security checks, signed firmwares, etc, but doing that on applications with a super high unit price tag seems out of reach... Or maybe, a few millions is like only a thousand hours of flying in jet fuel costs alone, not a big deal...
- digging 3y agoThis makes no sense and is difficult to even respond to coherently. > It's funny that as an industry we now know how to safely deploy software updates to hundreds of millions of phones, with security checks, signed firmwares, etc, Either you're completely wrong, because we "as an industry" still push bugs and security flaws, or you're comparing two completely different things. > doing that on applications with a super high unit price tag seems out of reach... is true because of > a few millions is like only a thousand hours of flying in jet fuel costs alone like do you really think they spent millions pushing a line of code? or do you think it's just inherently expensive to fly a jet, and so doing it twice costs more?
- the_sleaze9 3y agoI would generally pass this comment by, but it's just so distastefully hostile because you totally missed the point. GP's comment was expressing sardonic disbelief that a modern jet wouldn't be able to receive remote software updates, considering it's so ubiquitous and reliable in other fields, even those with much, much lower costs. Not that developers don't release faults.
- namaria 3y agoPeople tend to opine on systems engineering as if we had some sort of information superconductor connecting all minds involved. Systems are Hard and complex systems are Harder. Thinking of entire class of failures as 'solved' is kinda like talking about curing cancer. There isn't one thing called cancer, there's hundreds. There's no way to solve complex systems problems for good. Reality, technologies, tooling, people, language, everything changes all the time. And complex systems failure modes that happen today will happen forever.
- JackFr 3y agoTorpedoes typically have an inertial switch which disarms them if they turn 180 degrees, so they don't accidentally hit their source. When a torpedo accidentally arms and activates on board a submarine (hot running) the emergency procedure is to immediately turn the sub around 180 degrees to disarm the torpedo.
- mwcremer 3y agoLest someone think this is purely hypothetical: https://en.wikipedia.org/wiki/USS_Tang_(SS-306) https://en.wikipedia.org/wiki/USS_Tang_(SS-306)
- mrguyorama 3y agoA mark 14 torpedo actually sinking something? What a bad stroke of luck!
- kakwa_ 3y agoThe Mark 14 ended-up being a really good torpedo by the end of WWII. It even remained in service until the 80ies. In truth, and going back to this subject, the Mark 14 debacle highlights the need for a good and unbiased QA. This also holds true for software engineering.
- mrguyorama 3y agoMy understanding is the BeuOrd (or BeuShip? I don't remember which) "didn't want to waste money on testing it", so instead we wasted hundreds of them fired at japanese shipping that didn't even impact their target, or never had a hope of detonating. Remember these kind of things next time someone pushes for move fast and break things in the name of efficiency and speed. Slow is fast.
- jacquesm 3y agoIn NL folklore this is codified as 'the longest road is often the shortest'.
- jowea 3y agoYou would think "grep the codebase for FIXME" would be in the checklist before deployment.
- LorenPechtel 3y agoYup, watch videos of actual missile launches--the missile descends below the plane that fired it. Can't do that on the ground, although you won't blow up your base because the weapon will not have armed by the time it goes splat.
- jacquesm 3y ago> Yes this means that scene from the cheesy action movie (can't remember which one) where Arnold Schwartzenegger finds himself on the ground in the cockpit of a russian plane and proceeds to blow up all the badguys while on the ground couldn't happen in real life. I think you meant "Tomorrow Never Dies" and the actor was Pierce Brosnan. Took me forever to find that, is it the right one?
- seanhunter 3y agoYeah maybe. I think that sort of rings a bell.
- jacquesm 3y agohttps://youtu.be/hcIgZ4kJ5Ow?t=340 https://youtu.be/hcIgZ4kJ5Ow?t=340 this?
- seanhunter 3y agoThat is exactly it. For some reason my brain had spliced Schwartenegger into the cockpit. Funny how memory works.
- jacquesm 3y agoIt really threw me because I also remembered the scene but not the actor so I kept looking for Schwarzenegger movies. Good, checked that one off the list :)
- twic 3y agoOh, that's also the sequence with the "peace / war" switch! That did make me laugh. Turns out it's a real thing, though - but they probably wouldn't have flipped it in this situation.
- tialaramex 3y ago> if a (weight) load is detected on the landing gear This state "weight on wheels" is used in a lot of other functionality, not just on military aircraft, as the hard stop for things that don't make sense if we're not airborne. So that makes sense (albeit obviously somebody needed to actually write this function) Most obviously the gear retraction is disabled on planes which have retractable landing gear.
- metadat 3y agoRegarding [1], was it Red Heat, True Lies, or Eraser?
- dragonwriter 3y agoTrue Lies was an airborne Harrier, not a Russian plane on the ground. So, while there are many reasons the scene was unrealistic, “weight on gear disables weapons” isn’t one.
- metadat 3y agoI know, such a great movie, total classic of my childhood! It was the only R-rated film my mother ever allowed and even endorsed us watching, "Because Jamie Lee Curtis is hot." :D I wasn't sure if there might've been a scene I'd forgotten.