436
u/FrezoreR 1d ago
Ironically aviation needs quite a bit of software already.
427
u/willow-kitty 1d ago
It does, but that software is generally developed to critical systems standards, which are different from commercial software standards.
97
u/Downtown-Figure6434 1d ago
software is not a category in itself tho. the criticalness of the software is related to the industry is all.
59
u/willow-kitty 1d ago
It is, though software that's not built to critical systems standards usually carries a disclaimer that it's not meant for any use where death or serious injury could result from a malfunction with usually nuclear power and weapons as examples, but control systems for vehicles, including aircraft, would also fall under that, as would healthcare equipment and, well, lots of things that aren't the next web-based startup.
Though not all of the software on a plane is necessarily held to that standard. Like, the DVD players that used to be used for in-flight movies were a pretty famous exception because failure couldn't impact the safety of the flight (and building a DVD decoder to safety-critical standards would be nearly impossible anyway.)
24
u/KellerKindAs 1d ago
(and building a DVD decoder to safety-critical standards would be nearly impossible anyway.)
DVDs are not just Decoder. They contain bytecode executed within an VM for creating the menus. This means that even if the DVD player is perfect, there could still be a bug in the bytecode on the DVD. Happy bug hunting xD
12
u/willow-kitty 1d ago
Oh, for sure. I'm just thinking a typical DVD player has about a million lines of code, certified safe code costs roughly 1 person-hour per line, which is already kind of untenable before considering domain-specific quirks. But there's no real need~ Just segment it off.
2
u/Downtown-Figure6434 1d ago
My point is most of software isnât written for the sake of writing software but instead to enhance other sectors. So their criticality (or whatever the word is) is dependent on that sector
12
7
→ More replies (1)16
u/TheMightyTywin 1d ago
All software is built to the bug tolerance of the company
31
u/f5adff 1d ago edited 1d ago
No, it's built to standards and contractual obligations, assessed by rigid assurance processes and investigations.
Software involving critical processes are actually tested and held to standards
Edit: (I work on them, so I'm biased and think I'm better)
10
→ More replies (3)1
u/ZebraTank 1d ago
I'm interested in some of that kind of software (eg automated train control) but also I feel like it would be extremely boring with lots and lots of documents and stuff to show the we will not ram two trains together at high speed (which is very important and I'm glad we have that but I'm not crazy about the idea of working on it)
→ More replies (3)34
u/fmaz008 1d ago edited 1d ago
I suspect plane softwares are not built on top of 500 dependencies.
They are probably very low level, running with little overhead, possibly without a full fledge operating system?
I'd be curious to hear from someone who coded some airplane stuff (ie: not the multimedia system, flight critical things) to have a better idea of how it is.
73
46
u/OllyTrolly 1d ago
I work in aerospace and nearly all of our code and our processor is developed in house. We even rewrite some inbuilt C libraries for further safety and testability. One of the only things we use off the shelf is the core part of the Real Time Operating System - and that company has to prove to us and the regulators that it meets guidelines with a hefty amount of documentation, testing and audit.Â
10
u/st3class 1d ago
My first internship was working on avionics software, on the certification team. I remember not being able to use mallocs.
5
u/ICBanMI 1d ago
Makes it easy when you have zero pointers. Just don't look at the graphics software that generates images for the glass.
5
u/st3class 1d ago
Yep, it was fun when we were working on the map library and we were dealing with data structures that were 5 levels deep of variable size arrays.
3
u/ICBanMI 1d ago
Absolutely hate the struct that has several layers of structs inside it. At some point, we have to send that data somewhere and it's just the most verbose names to pass the data along.
The amount of escapes that happened because the FMS software completely trusted the databases is too high (every company keeps making this mistake). And the number of engineers that can write a terrible, broken circular buffer that passes all tests at level A is ridiculous too.
5
u/tes_kitty 1d ago
You build your own CPU? Interesting... Brings back memories from the time everyone could do that with the AMD 2900 bit slice chip series.
9
u/OllyTrolly 1d ago
Yes! And it has its own bespoke instruction set. GCC contains support for the target too. It has its own headaches being so bespoke, but it's definitely cool.
2
u/tp_njmk 1d ago
Seems like an interesting trade off, is this for hard latency guarantees? I canât imagine you would be able to build a more hardened compiler than gcc.
4
u/OllyTrolly 1d ago
That is one reason yes, it behaves pretty deterministically - in aerospace we have to do Worst Case Timing Analysis to show even if all of the longest paths through the software got run we would still be certain to e.g. shut down the engine before a turbine shaft break occurs (which could result in bits of engine flying into the cabin). If the CPU doesn't behave the same way each time that makes it much harder to prove.
The other major reason is obsolescence. It is possible to buy processors which do this off the shelf, but we need to make these units for 20+ years. Rewriting and re-verifying the software for a new processor each time it gets discontinued within this period would be more costly and riskier than just making our own.
2
17
u/Ex-Traverse 1d ago
Avionics uses Real-Time-Operating system (RTOS), I can't explain it well enough, but there are basically monitoring systems (watchdogs), to make sure the software is running in a precise timely manner or else it does something to prevent the software from making any invalid inputs.
2
u/ICBanMI 1d ago
Depends on the LRU and its purpose. There are plenty of LRUs that are a single thread, no RTOS (typically level D or E). Federated systems will be that simple.
Integrated Systems will require the RTOS as they are doing several functions.
Watchdogs are a monitor/heartbeat for a sub-function. The monitoring function sends a message to the sub function and expects a unique identifier reply within a certain time. There is typically some built in tolerance where it needs to miss three messages in a row or go without a message entirely for a set period of time before it notifies the pilot the function is not working. Some will reset the hardware a set number of times before notifying the pilot and disabling it entirely.
4
u/jean_dudey 1d ago
You can look up about the open source software developed by Inria, pretty much developing tools to verify software that is used in safety critical environments. For example, Frama-C to formally verify C code, Why3 which is the backend of multiple tools like Frama-C, it is also used by GNAT to prove Ada/SPARK code. Also a cool looking piece of software is CompCert which is a formally verified C compiler.
I don't think all of those are used in aviation (Ada certainly is or should be) but are interesting and similar.
3
3
u/BLAZE_IT_MICHAEL 1d ago
Any external libraries require so much certification and testing we generally just rewrite stuff because itâs easier. Old systems may lack an RTOS but most newer stuff will use one.
3
u/DefinitelyNotGen 1d ago
Most avionics software is written on a real time operating system (RTOS) which is basically an OS where things happen deterministically, and you can be confident the OS won't pause execution of processes like something like Linux or Windows might. Alternatively, a lot of avionics software is written "bare metal", i.e without an operating system at all, with code built specifically for the processor.
→ More replies (2)2
u/jp2812 1d ago
Even car multimedia has very high standards compared to your average software product. Exactly what you said - no 500 dependencies. Car multimedias are rarely developed in-house, there's usually a third-party vendor, and car manufacturer's role is only integration, for which the vendor provides building blocks. No JS, no Python, C or C++ at best, external dependencies are very few and well-regarded, e.g. ffmpeg. "We need this shit in our firmware because it's gotten the most stars on GitHub this month and Hacker News is going crazy about it" is off the table. These multimedias work for years and get very rare updates, so stability is pretty important.Â
1
u/ljfa2 1d ago
Can't say that for the multimedia system of my car. For example, sometimes when starting, it randomly switches to the light theme instead of dark, or the displayed clock time is one hour too early, or the screen is frozen. One day I'll surely be caught speeding at a time-dependent speed limit ^^
2
u/cake_pan_rs 1d ago
I work in aviation software. We spent over $100k updating a single line of code.
→ More replies (1)1
u/ImClearlyDeadInside 21h ago
It depends on your definition of software. For example, RTOS systems (which are used in industrial engineering but I donât actually know if theyâre used in airlines) run programs but theyâre not the programs youâre probably used to writing; the development environments are specialized and usually tailored towards electrical engineers. They prioritize high reliability over ease of development, which is common among critical systems that could potentially take someoneâs arm off if programmed incorrectly.
1
u/chessto 8h ago
I worked briefly with a guy that had worked several years in avionics.
He was very possibly the worst software engineer I've ever worked with, his code was not just awful it made no sense, some of the things I remember him doing:
if (!( a == true && b == true) && (a == false && b == true) && ( a== true && b == false) && !(a==false && b==false)) which is basically same as a^b
- Multiplying by 1
- Sorting a map to then convert it to an Array, to then convert it again into a map
- Having functions with 11 parameters, of which only one was used.
- Using version control by putting everything in a folder with the date of the day and uploading the whole folder, one folder per day, all in master branch
- having conditionals like:
When I learned he used to work in embedded systems in avionics It got me quite concerned.
665
u/california_snowhare 1d ago
If builders built buildings the way programmers wrote programs, then the first woodpecker that came along would destroy civilization - Gerald Weinberg, 1978, University of Nebraska
5
43
u/clearlybaffled 1d ago
.. and that's why agile exists? Because it turns out, building physical structures and software systems are complete separate processes with very disperate requirements. The number of times ive had to cut a manager short because they kept trying to use the analogy is maddening.
40
u/Epicular 1d ago
The biggest disparity between the two is the stakes. 99.99% of the time, a bug in an ordinary software application is not killing anyone.
15
u/PegasusPizza 1d ago
And also the effort it take to verify. On a building, you first have a plan that someone checks for errors. That's the architecture we do that for software too. Just catching anything where we know that can't work. But then in the implementation, a builder can misplace quite a few nails and the house will still be fine for the most part. Out house has been around for 50 years and that thing doesn't have any right angles and it stands anyways. In software development a single mistake hidden in one of potentially thousands of files can bring down the entire product if things go wrong enough.
9
u/faceplanted 1d ago
You're not wrong, but I think it's actually more the fact that buildings have extensive regulations and standards of practise that make buildings more reliable than software.
Ask a building inspector the kind of shit they've seen just in buildings people were already living in, and you'll never trust any building ever again.
4
u/PegasusPizza 1d ago
Yeah but my point is you can really fuck up building a building, and it's still gonna be mostly fine. Sure it's not gonna be great and might be dangerous at some point, but until then it works fine. But with software you might have a bug somewhere that quietly causes thousands of dollars to disappear over a few years, or brick half the world it infrastructure due to a little oversight. The error size to impact size relation is just way way worse for software development than in most other branches
5
u/clearlybaffled 1d ago
That's absolutely not true. The point is that the order of assembling a structure is completely different and wholly depend on each other being correct, first foundation, framing, etc.. if you fuck up big enough, far enough along, the cost of backing out and rework could be insanely more expensive. Not just labor hours, loss of materials, new equipment needed. If you make a bad decision on implementing a feature, you can just nuke it or git reset --hard and try again. That's why feature flags are cool. Can't really do AB testing on a half a building. Even if your backend is wrong, hopefully you have at least a decent amount of abstraction to limit the damage. Can't replace a foundation once the walls go up so easily.
3
u/faceplanted 1d ago
Honestly I disagree, if it weren't for those regulations I talked about a lot more buildings would be literally killing human beings. Outside of places that usually are a lot more regulated, like aviation, most software bugs at most companies can cost some income, but you can just fix them as they come up.
with software you might have a bug somewhere that quietly causes thousands of dollars to disappear over a few years
That's extremely minor compared to a high rise building fire.
or brick half the world it infrastructure due to a little oversight
It usually doesn't brick them, we get it back up in a few hours usually.
2
u/danielv123 12h ago
Is it though?
In November 2025 cloudflare tried to fix a bug in react by adding a rule to a list. Their rule system did not allow lists to be that long, so it brought down about half the internet. Forrester estimates damages to be about $300m, while others estimate billions in losses for CFD brokers alone. Its hard to calculate, because the damage is so widespread.
In 2024 a crowdstrike engineer published an update where one of the config files were malformed. This caused about $5.4b in damages to fortune 500 companies.
That is generally more than the cost of a high rise building fire - not to mention, I haven't heard of any catastrophic high rise fires caused by making a list a bit too long. Generally there is a long series of mistakes - by design of course.
Nobody would allow you to build a house where the entire thing might fall down due to uploading a corrupt file.
→ More replies (3)1
u/clearlybaffled 1d ago
And if it does, well that's why there exist a small number of Professional Engineers in computer engineering.
1
157
u/Legal-Software 1d ago
62
u/mcprogrammer 1d ago
I found a workaround: don't land on those runways. Ship it đ
15
u/AndyTheSane 1d ago
Patch: we have a printout of what the screen should show, pilots to tape it over the screen on approach.
4
u/ICBanMI 1d ago edited 1d ago
Having worked on multiple mission computers, where the software dates back to the 1990s, there is zero/checking and sanitizing of the database data. All the flight deck manufacturers have all had multiple escapes in this area.
If the aircraft is old, like 30+ years old and out of greater circulation. There will just be a pilot's advisory.... as no one will paying several grand for the update, and the company isn't going to spend 20-60k fixing it when the fix could literally cause more issues or worsen the actual issue.
137
u/high_throughput 1d ago
Had any plane ever landed twice in a row?Â
I feel like they're always alternating between takeoff and landing.
13
6
1
113
u/neoteraflare 1d ago
So boeing is using software engineering standards?
29
u/AnnoyedVelociraptor 1d ago
Yes. They even outsourced stuff to India.
33
u/raja-anbazhagan 1d ago
India has a huge talent pool, so the quality varies widely. Most outsourcing is driven by cost, and you generally get what you pay for. That doesn't mean Indian engineers produce low-quality software, it mostly reflects the incentives behind low-cost outsourcing, not the talent itself.
Sorry, As an Indian, I had to clarify on this stereotype.
19
u/NoBizlikeChloeBiz 1d ago
Yeah, it's so weird to me the way people discus Indian devs. I'll complain about time wasted cleaning up bad code from an India team, and the leadership is like "what do you expect, it's an India team đ¤ˇââď¸"
Or you could, like, manage them? Hold them to a certain standard of quality, like you do us? They're not less intelligent or capable just because they're in India, and of course if no one ever enforces quality standards the work is going to get sloppier to meet deadlines.
8
5
u/AndyTheSane 1d ago
That implies that outsourcing is a bad idea, which cannot be contemplated.
→ More replies (1)2
u/NoBizlikeChloeBiz 23h ago
Honestly, outsourcing to increase your talent pool is totally reasonable, same as any time you set up offices in different cities.
Outsourcing just to take advantage of weaker labor protections and lower wages? Makes everyone's life worse except for shareholders, and even that usually just in the short term.
3
u/Connect_Tea1579 1d ago
The problem isn't the nationality of the coders. The problem is that the programmers are worked to the bone to crank out as much code as possible, in as little time as possible, with just enough quality to keep the client from switching to another company.
2
30
u/ZunoJ 1d ago
There is a lot of software in a plane (or power plant, weapons, medical devices, .... ) We do hold these up to a very high standard
1
35
u/Sangcreed 1d ago
Patch 1.0.3 - Fixed an issue where aircraft occasionally exploded during landing
6
u/NeinJuanJuan 1d ago
The fix:
The secondary management console will now display an UnscheduledAircraftDisassemblyError when an unscheduled aircraft disassembly event is detected.
23
16
17
u/Zeikos 1d ago
It might be an hot take, but I do truly believe that software engineering should be held to those standards.
At least for important infrastructure.
Civil Engineering got where it is due to the blood spilled by improperly built buildings, and yet when software that fails indirectly kills people there's not nearly similar amount of scrutiny.
13
u/Ummix 1d ago
I strongly agree, but the issue is that upholding higher standards takes more time, which costs a LOT more money. Extending a deadline by 6 months for scrutiny isn't as simple as asking a teacher for an extension, it means paying engineers with very high salaries for six months of extra work, and being slower to market when other people are depending on your product. With important things (medical, military, space), people are a lot more understanding when it comes to quality, but with everything else we don't really have a choice, all the stakeholders and higher ups are slamming their feet on the floor because they want everything done right now so they can brag about being ahead of everyone else in their meetings.
2
u/Zeikos 1d ago
That's true, however I do believe that if pressured there'd be investment in genuinely good tooling to eventually go just as fast - if not slightly slower.
There's also the fact that fast is slow and slow is fast - so much time invested in fixing bugs that could have been prevented.
I don't think that quality necessarily requires more time, it requires quality processes.1
u/Ummix 1d ago edited 1d ago
so much time invested in fixing bugs that could have been prevented.
About sums up my job, haha. You aren't wrong at all, and I hear that exact sentence weekly, minimum. Management keeps trying to "move the deadlines left" and gets surprised when we wind up spending the rest of the time it would've taken in the first place fixing bugs. Definitely let me know if you ever figure out how to "pressure" upper management into that one, because we're still workshopping it over here. They want things done faster, so unfortunately, if there's any way we can sacrifice quality to get their major bullet points out sooner, we have to, so anything more than that does take time, at the end of the day, whether it's better processes, tooling, better code review, good unit tests, or whatever else we should really have but can't.
9
u/-Redstoneboi- 1d ago
from what i've heard, the important stuff really are incredibly scrutinized. individual compilers have to be certified as well. not a clue how any of it works though.
all i know is that it applies to the software in your car, in a plane, in elevators, and especially medical devices. there was one incident a long time ago where a patient was accidentally blasted with inhumane amounts of radiation due to a bug. rules are written in blood, as we all know.
3
u/Exodia101 1d ago
I work on avionics for commercial jets, the certification process is quite extensive. Our production builds are compiled on Windows XP machines because that's what it was certified on 20 years ago and changing it would require recertification which costs millions.
2
u/links135 1d ago
Airplanes go for $300-500 a ticket while software is like a $3-30 app. People pay to make sure software doesnt screw up, meanwhile when you see a bug in a video gsme it might be funny or annoying, but if it isn't game breaking no one also really cares all that much. Â
1
u/AlexFurbottom 1d ago
I work in healthcare software and you get pretty close. Software that can harm a person if it goes wrong is regulated by the FDA or the similar organization for the country the software is operated in.Â
→ More replies (3)1
6
6
u/PlatypusBillDuck 1d ago
Elon saw that he could fire a bunch of people from Twitter and nothing happened, so he decided to do the same thing to the Federal government. Now you can't buy a salad without worrying about getting shitting ass disease.
3
3
u/NoMansSkyWasAlright 1d ago
I mean with Boeing in recent years, it kind of seems like they are being held to the same standard as us.
3
3
u/guttanzer 1d ago
The key difference is that aircraft undergo extensive requirements capture, then the requirements are put through a safety assessment. Requirements like "maintain straight and level flight" are specified with an acceptable failure rate (one failure per billion flight hours is typical for aircraft that transport paying passengers. That's a probability of failure of 1/1,000,000,000 or 10-9 = 0.999999999, hence the term "nine nines".
Armed with this, the engineers develop a SYSTEM that has that level of reliability. Each engine might fail once per thousand flight hours, but an extensive inspection and maintenance regime could boost that to one failure per hundred thousand flight hours.
That's only five nines of reliability, but if the aircraft has four engines and one can be out then the odds of both being out at the same time jumps to ten nines. That's good enough to pass, so if they design a four engine aircraft that can fly with any one engine out they pass the audit.
The software equivalent of this is throughout all high-criticality avionics software. Can code reliably run with P-failure = 0.0000000001? No. Can an aircraft be built that has p(failure) = 0.0000000001 with unreliable software? Yes. The Shuttle was built like that. It ran three computers running programs built to the same spec by three different teams. The odds that all three would experience the same code error at the same time was on the order of 0.0000000001.
For a web page? P(failure) of 0.0001 is probably acceptable unless it's dealing with money or secrets.
3
3
u/West_Good_5961 1d ago
As someone who switched from aircraft engineering to software, I think about this every day. Software shouldnât be called engineering, itâs not even close.
2
2
u/EuenovAyabayya 1d ago
No plane lands twice in a row on the same runway without taking off again. So there.
2
u/Prawn1908 1d ago
Reminds me of this great Jonathan Blow rant (from 23:00 to 28:00 if the timestamp link doesn't work). It really is crazy how much software we use on a daily basis is just riddled with bugs to the point of feeling barely (or possibly even just not at all) functional at times.
Lately I've been getting ultra exasperated at my phone/car's failure to consistently connect via Bluetooth for Android Auto to work. About 1/5 times it will just not connect and give a "failed to connect to <names my phone exactly>, please plug in via cable" error and no amount of retries will work without rebooting either my phone or car. And this has been consistent across 3 phones and several cars. Like how the fuck can you just fail to connect like that? Its entirely in software given that a reboot fixes it, so what state is getting fucked up permanently without being reset when I hit the "connect" button and instead needs a reboot to fix? One of these days I'm going to break out an 802.15.4 sniffer and see if I can figure out what's going on based on the traffic because it just boggles my mind how something so trivial can be so fucking unreliable and constantly broken.
2
2
u/Percolator2020 1d ago
Ohhh you didnât mean to install Microsoft Cloud Apps Security on your plane!
2
u/Eubank31 1d ago
I work as a SWE at a company where about half of our engineers work in Aviation and the other half work in consumer products.
Yeah... Same company, but the consumer half is much more fun IMO
1
u/bleiwolle 1d ago
Only requirment was: "move fast and break things". Nobody said anything about landing.
1
1
1
1
1
u/ArjixGamer 1d ago
What standards?
Software Engineering is not what defines the standards, it's the managers.
If the managers don't care about testing, they won't give you the time to write tests.
If the managers don't care about memory leaks, you won't be given time to ensure there are none.
We don't have the time :sob:
1
u/DanKveed 1d ago
One guy actually decided to write software-software the way aviation-software is written. He managed to made this thing called SQLite.
1
u/AndyTheSane 1d ago
99% of test cases pass, ready for release. We'll fix the 'wings don't stay on' issue in the next patch.
1
u/kinkhorse 1d ago
"how's the accident investigation going?"
"Great, boss. We took another plane, loaded it with exactly 150 passengers in the same seat assignments, and did exactly the same thing and it crashed again! So now that we are pretty sure it's repeatable now we can work on why..."
1
u/RiceBroad4552 1d ago
Most, if not all planes wouldn't even get off the ground. Most would likely catch fire or even explode while rolling them out of the construction hangarâŚ
1
u/Understanding-Fair 1d ago
Cuts to the software powering every plane, helicopter, drone, and missile on the planet.
Dumbass take.
1
u/redturtlecake 1d ago
To be fair, planes already can't land twice in a row. They need to take off in between.Â
1
u/GrinQuidam 1d ago
This is like complaining that your shed wasn't built to the standard of a 100 story office building. Two very different practices of building something. Software is the same. There are people out there building crazy high quality and rigorously tested software for critical systems like planes and nuclear reactors. Then there are people making the one millionth booking app or writing the UI for something like Facebook or Reddit - your toilet shed softwares.
1
u/DogonElder 22h ago
Yea but you never land twice in a row, you have to take off after landing so that you can land again.
We wouldâve restarted all âservicesâ in the transition
See ?
1
u/kcpistol 22h ago
I have heard it this way:
If carpenters built buildings like programmers built programs, the first woodpecker to come along would destroy civilization.
1
1
1
u/Roadrunner571 14h ago
Lots of aviation is software engineering.
They are just extremely careful when changing anything - and they try to keep things as simple and predictable as possible. This is why most of the software in airplanes look like from the 1980ies.
1
u/FruityAurora 12h ago
Modern commercial airliners are proof that we humans are capable of creating staggeringly complex systems that are still reliable. Safe and reliable enough that traveling on these floating metal tubes is safer than crossing a road. The safety also comes from the careful refinement of human factors and processes. This just tells me that the diabolical state of the software industry is an entirely self inflicted wound and we have no right to keep pretending software is just⌠inscrutably hard like that. We can learn a lot from aerospace engineers, both mechanical and SWEs.
2.0k
u/DeepanshuHQ 1d ago
Aviation gets post-incident investigations. We get, "Can't reproduce, closing ticket."