Hacker News Reader

Comment by burfog | Hacker News Reader

It's proper. This is exactly how you do things with life-critical embedded software. You detect when things are crazy, which of course shouldn't happen but nevertheless does, and you react in a way that is hopefully not disastrous.

The alternative is to ignore the problem.

Sensors go bad. Actuators go bad. Voting hardware goes bad. Message routing goes bad. Even the RAM sometimes goes bad.

When the hardware is failing ("specific streams of erroneous flight data") there isn't going to be a reliable solution. You can't even fully enumerate all the possible failures. How could you possibly guess that a message routing chip now flips bit 7 in every angle-of-attack measurement?

Boeing's answer is standard: when the values look crazy, stop doing stuff that might make the situation worse.

View on HN

The way I read it they are not detecting malfunctioning sensors, but essentially a computer fault caused by it's inability to deal with erroneous input. Rather than fixing the computer, they are essentially wrapping a great big try/catch around it....good God.

That interpretation seems like a stretch to me.

The way it's worded, that's exactly the interpretation that a lot of us in this thread get. If this is not actually the case, they should really word it differently.

This is the same Bloomberg that reported on the SuperMicro hardware "compromise."

> are not detecting malfunctioning sensors

Because most of the time you can't. There is no reliable way of knowing when the sensor is lying to you.

You might try to reduce the probability of it happening and try to make it warn you (for example, redundancy, etc), but in aviation, even things that have a probability of failure of 10e-6 or even lower must be considered. 0% chance of reading an erroneous value doesn't exist.

The computer can deal with suspected erroneous input: it can ignore it. There. That's the standard way.

But what's erroneous input? A bit is flipped? A .1V increase over 0 makes it a logical 1, when it should be .3V? I mean, this is the domain of computer/electrical engineers in the first place, to prevent these kind of problems. This is what happens when you outsource your critical components to 3rd parties.

I suspect your take is correct but I understand the alarm from the previous poster as the way it's worded makes it sound like they'll look just for condition X, Y and Z and _then_ take action versus your explanation which looks for a lot of incoming, bad data and then handles it.

This might just be a bad case of people talking past one another.

what happens when things are actually crazy and it causes a crash itself?

Reply on news.ycombinator.com