3 ms·

I call BS on 12 9s. To actually meet that a system operating for all of the common epoch would have only 60 milliseconds of downtime. There is no way since Wilb

by wbl 3y ago

I call BS on 12 9s. To actually meet that a system operating for all of the common epoch would have only 60 milliseconds of downtime. There is no way since Wilbur and Oliver that any aerospace system could accomplish enough runtime to be sure it isn't 11 nines instead. As for your actual point most systems would be better with a GC'd memory safe language then the hard real time those specs you mention are written from.

Veserv 3y ago
I am not talking about individual airframes. I am talking about quality of service over the entire fleet. Note that I will be using terminology more fit for IT than actual safety-critical system terminology to highlight the analogous elements. The DO-178 standards were instituted 30 years ago [1]. There are ~700 million passengers per year flying on commercial airlines in the US since 2003. Extrapolating that backwards to 1992, that would be ~20 billion service requests fulfilled. In 2019, the US averaged 1.57 trillion passenger miles over ~1 billion passengers resulting in a average flight of 1500 miles. That corresponds to around 3-4 hours on average at cruising speed. It takes around 3 minutes for a plane at cruising altitude to crash. So, since the DO-178 standards were introduced there have been 1.6 * 10^12 safety-critical service segments where a software failure over that period could cause a fatality. There have been exactly zero fatalities connected to software errors since the DO-178 standard has been introduced. So, over 1.6 * 10^12 service segments every single one of them was successfully delivered by the software without failure. 12 9s. Also, just in case it is not clear, calculating over multiple airframes does not result in redundancy reducing error rates. Every single airframe must succeed in their service of every single requested service. An analogous situation in IT would be having 10,000 servers with zero redundancy achieving 5 minutes of total downtime divided over all 10,000 servers resulting in 9 9s reliability. [1] https://en.wikipedia.org/wiki/DO-178B https://en.wikipedia.org/wiki/DO-178B
flohofwoe 3y ago
> There is no way since Wilbur and Oliver that any aerospace system could accomplish enough runtime to be sure it isn't 11 nines instead. Especially when some plane models need to be rebooted every couple of weeks because of software bugs ;) https://www.theregister.com/2020/04/02/boeing_787_power_cycle_51_days_stale_data https://www.theregister.com/2020/04/02/boeing_787_power_cycl...

by wbl 3y ago

Veserv 3y ago

I am not talking about individual airframes. I am talking about quality of service over the entire fleet. Note that I will be using terminology more fit for IT than actual safety-critical system terminology to highlight the analogous elements. The DO-178 standards were instituted 30 years ago [1]. There are ~700 million passengers per year flying on commercial airlines in the US since 2003. Extrapolating that backwards to 1992, that would be ~20 billion service requests fulfilled. In 2019, the US averaged 1.57 trillion passenger miles over ~1 billion passengers resulting in a average flight of 1500 miles. That corresponds to around 3-4 hours on average at cruising speed. It takes around 3 minutes for a plane at cruising altitude to crash. So, since the DO-178 standards were introduced there have been 1.6 * 10^12 safety-critical service segments where a software failure over that period could cause a fatality. There have been exactly zero fatalities connected to software errors since the DO-178 standard has been introduced. So, over 1.6 * 10^12 service segments every single one of them was successfully delivered by the software without failure. 12 9s. Also, just in case it is not clear, calculating over multiple airframes does not result in redundancy reducing error rates. Every single airframe must succeed in their service of every single requested service. An analogous situation in IT would be having 10,000 servers with zero redundancy achieving 5 minutes of total downtime divided over all 10,000 servers resulting in 9 9s reliability. [1] https://en.wikipedia.org/wiki/DO-178B https://en.wikipedia.org/wiki/DO-178B

flohofwoe 3y ago

> There is no way since Wilbur and Oliver that any aerospace system could accomplish enough runtime to be sure it isn't 11 nines instead. Especially when some plane models need to be rebooted every couple of weeks because of software bugs ;) https://www.theregister.com/2020/04/02/boeing_787_power_cycle_51_days_stale_data https://www.theregister.com/2020/04/02/boeing_787_power_cycl...