4 ms·
In aerospace? Extremely well. Software (in context) that is subject to DO-178 certification is generally more reliable than the plane hardware. This is an indus
by Veserv 3y ago
In aerospace? Extremely well. Software (in context) that is subject to DO-178 certification is generally more reliable than the plane hardware. This is an industry where the 737 MAX, a plane safer than driving per-mile, is considered a death trap because the standard for safety is being 1000x safer than driving.
The software in one of the highest reliability industries is one of the highest reliability components. Unlike in other industries, especially consumer electronics, where even in low reliability products the software is almost always the lowest reliability component.
To put a more concrete take on this. In consumer systems, 5 9s is viewed as a gold standard. A level to aspire to, not necessarily one to achieve. In critical aerospace systems, 9 9s is viewed as the minimum, a level to never drop below. Many systems see 12 9s or higher.
The minimum standard in aerospace is 10,000x higher than the maximum standard in consumer. And the software reaches and exceeds that standard. That is how far the gap is and how well it works.
However, the downside is the expense and time. But, this can be mitigated by only applying these techniques where it matters. A key component of the DO-178 standard is identifying how critical each portion of the software is. You then only apply the most rigorous techniques for the highest criticality pieces. Of course, this requires the pieces to be well isolated, so that errors in one piece of non-critical code can not affect critical code; otherwise the non-critical code is actually, transitively, critical and thus demands increased rigor.
These techniques are tried and true in the most demanding circumstances. It would be prudent to start from these expensive working standards and work downwards to invent cheap working standards rather than fixing cheap non-working standards into cheap working standards. I think every software developer here can attest to it being much easier to start from something working, no matter how crude, than to start from something broken.
- wbl 3y agoI call BS on 12 9s. To actually meet that a system operating for all of the common epoch would have only 60 milliseconds of downtime. There is no way since Wilbur and Oliver that any aerospace system could accomplish enough runtime to be sure it isn't 11 nines instead. As for your actual point most systems would be better with a GC'd memory safe language then the hard real time those specs you mention are written from.
- Veserv 3y agoI am not talking about individual airframes. I am talking about quality of service over the entire fleet. Note that I will be using terminology more fit for IT than actual safety-critical system terminology to highlight the analogous elements. The DO-178 standards were instituted 30 years ago [1]. There are ~700 million passengers per year flying on commercial airlines in the US since 2003. Extrapolating that backwards to 1992, that would be ~20 billion service requests fulfilled. In 2019, the US averaged 1.57 trillion passenger miles over ~1 billion passengers resulting in a average flight of 1500 miles. That corresponds to around 3-4 hours on average at cruising speed. It takes around 3 minutes for a plane at cruising altitude to crash. So, since the DO-178 standards were introduced there have been 1.6 * 10^12 safety-critical service segments where a software failure over that period could cause a fatality. There have been exactly zero fatalities connected to software errors since the DO-178 standard has been introduced. So, over 1.6 * 10^12 service segments every single one of them was successfully delivered by the software without failure. 12 9s. Also, just in case it is not clear, calculating over multiple airframes does not result in redundancy reducing error rates. Every single airframe must succeed in their service of every single requested service. An analogous situation in IT would be having 10,000 servers with zero redundancy achieving 5 minutes of total downtime divided over all 10,000 servers resulting in 9 9s reliability. [1] https://en.wikipedia.org/wiki/DO-178B https://en.wikipedia.org/wiki/DO-178B
- flohofwoe 3y ago> There is no way since Wilbur and Oliver that any aerospace system could accomplish enough runtime to be sure it isn't 11 nines instead. Especially when some plane models need to be rebooted every couple of weeks because of software bugs ;) https://www.theregister.com/2020/04/02/boeing_787_power_cycle_51_days_stale_data https://www.theregister.com/2020/04/02/boeing_787_power_cycl...