Hacker News Reader

Comment by tibbydudeza | Hacker News Reader

Airbus has 3 flight computers (1 PRIM and two SECs) for fly by wire - they run same software with voting deciding outcomes of commands that comes from the pilot to the flight surfaces.

The unit not matching the others are marked as suspect and removed from flight operations-the switch out is not done by software but hard cutover system using relays.

Good design.

View on HN

I think they’re talking about the pilot being able to apply inputs that might otherwise be considered dangerous by the flight control computers.

So in an emergency a Boeing may allow the pilots to make an input that may overstress the airframe but save the lives of the passengers. Whereas the Airbus computer would override the pilot’s decision and not allow it.

IANAP so I have no idea if that’s true or not.

You can dump an A3xx to "direct law" if you turn off the right switches and get direct controls.

ECAM memo: "DIRECT LAW (PROT LOST)"

https://apstraining.com/wp-content/uploads/FCS-Airbus-Quick-...

Isn't the MCAS situation the exact opposite? Boeing pilots tried hard to override it, but it wouldn't let them.

Yes, it's one of the most notable aspects of MCAS, that it departs from previous Boeing design philosophy.

Yes but MCAS is relatively recent, the controversy in GP happened when fly by wire was a new concept.

More or less that - the rationale being that pilots could overreact in stressful emergency situations and thus the flight control system would prevent unintentional damage that would only make the situation worse.

> Airbus has 3 flight computers (1 PRIM and two SECs) for fly by wire - they run same software with voting deciding outcomes of commands that comes from the pilot to the flight surfaces.

So a software bug could doom the plane?

IIRC, some other flight-control voting system have 3 computers, but one runs software developed independently from the others.

Boeing 787 is also fly-by-wire.

Yes, software is life-critical. Therefore it is developed to a very high standard. Ada is often used.

I heard the military relaxed restrictions that required Ada. So the F-22 Raptor was mostly Ada, but the newer JSF is mostly C++. No idea if true, but that is what I remember.

> I heard the military relaxed restrictions that required Ada. So the F-22 Raptor was mostly Ada, but the newer JSF is mostly C++. No idea if true, but that is what I remember.

I think that's correct. IIRC, the JSF C++ coding standard document is floating around.

I would certainly hope that it's the MISRA variant.

https://en.wikipedia.org/wiki/MISRA_C

> I would certainly hope that it's the MISRA variant.

I think this is it: https://www.stroustrup.com/JSF-AV-rules.pdf, and it appears you're right:

> The MISRA Guidelines were written specifically for use in systems that contain a safety aspect to them. The guidelines address potentially unsafe C language features, and provide programming rules to avoid those pitfalls. The Vehicle Systems Safety Critical Coding Standards for C, which are based on the MISRA C subset, provide a more comprehensive set of language restrictions that are applied uniformly across Vehicle Systems safety critical applications. The AV Coding Standards build on the relevant portions of the previous two documents with an additional set of rules specific to the appropriate use C++ language features (e.g. inheritance, templates, namespaces, etc.) in safety-critical environments.

Reply on news.ycombinator.com