20 ms·
I thought planes had insane redundancy exactly so stuff like that don´t happen. How can a bit flip cause the system that controls altitude to malfunction like t
by SwiftyBug 10mo ago
I thought planes had insane redundancy exactly so stuff like that don´t happen. How can a bit flip cause the system that controls altitude to malfunction like that?
- bdangubic 10mo agoif (cosmic_ray) { do_not_flip_bits() } else { flip_away() }
- rjp0008 10mo agoWhat if in the time between initialization of cosmic_ray to False, and the time this if statement executes, a legitimate cosmic ray flips the bool bit representing cosmic_ray?
- wavemode 10mo agoah, a classic TORTOF bug (time-of-ray, time-of-flip)
- sunrunner 10mo agoThis is a really good point and a common error in bit flip detection code. To avoid this kind of look-before-you-leap hazard the following is recommended: try { do_action() } catch (BitFlipError e) { logger.critical("Shouldn't get here") } Ask-for-forgiveness as an error detection pattern avoids these kinds of errors entirely.
- terminalshort 10mo agoSimple! Make it an int. int cosmic_ray = 0 if (bool(cosmic_ray)) { throw cosmicRayException() }
- willis936 10mo agoWhy would you ever expect one bit flip? You have a flip rate and you design your system to tolerate a certain bit flip rate. Assumptions made during requirements establishment were wrong and nature eventually let them know they had negative margin.
- p_l 10mo agoPossibility of bit flips from cosmic radiation only really came to fore in 1990s, and some aircraft and parts predate that.
- 15155 10mo agoSmaller semiconductor feature size greatly increases the likelihood of these types of errors.
- p_l 10mo agoFor a long time ECC brought most of effect as hedge against failing silicon, and local EMI. Aviation had benefit of careful EMI designs and appropriately selected chips, so it was seen less of a benefit...
- procflora 10mo agoFrom what I've heard (FWIW), Airbus released a version of the software for one of the flight computers that removed SEU protections (hence grounding affected models until they could be downgraded to the previous version). There was still hardware redundancy though. Operation of the plane's elevator switched to a secondary computer. Presumably it was also running the same vulnerable software, but they diverted and landed early in part to minimize this risk. So not just redundancy but layers of redundancy.