[userbinator]

For example, let’s imagine that the timestamp set by the transmitting ES is close to its wrap-around value. After performing the required calculation, the receiving ES obtains a timestamp that has already wrapped-around, so it would look like the message had been received before it was actually sent.

Isn't it surprising that modulo arithmetic, as already employed successfully in TCP sequence numbers and the like, still seems to be incorrectly implemented today? What's more disappointing is seeing all the other incredible systemic complexity they've added, and yet the plane appears to have no mechanical backup instruments?

[steffan]

To address the second part:

> and yet the plane appears to have no mechanical backup instruments[?]

This is unlikely in a modern aircraft because mechanical instruments to back up e.g., the artificial horizon / attitude indicator or directional gyro (DG) / heading indicator are:

1) Mechanically complex - the attitude indicator and DG make use of gyroscopes which rotate at up to 24,000 RPM along with other mechanisms. They are typically powered by vacuum or electric motors which consume relatively more power (or require vacuum lines and a vacuum pump)

2) Expensive to maintain - see (1) - they need to be serviced somewhat regularly

(3) Heavier than their solid-state counterparts

(4) Have [dramatically] different failure modes - instead of a display going dark, a DG will slowly drift as the gyroscope precesses, giving erroneous values. Same with the artificial horizon. This can lead to catastrophic results under instrument meteorologicalconditions (IMC) where the pilots rely solely on instruments to maintain essential things such as heading and level flight.

(5) Because of (4) they require additional redundancy to ensure instruments can be cross-checked with one another. This compounds (2) and (3)

[caconym_]

I think you are overstating the impracticality of mechanical standby instruments. Even glass cockpit GA aircraft typically came with fully mechanical backups until fairly recently---check out this SR22 cockpit as an example: https://commons.wikimedia.org/wiki/File:SR22TN_Perspective_C...

"Glass" standby instruments come with significant upside and not much downside, which is why they've been preferred in larger/more expensive aircraft for a while. There is nothing inherently more or less reliable about them, being fully isolated and redundant just as old-timey mechanical backups are, and they offer a much richer presentation (typically like a small PFD). However, new things are usually more expensive, which IIUC is why they were adopted first in larger, more expensive aircraft. They were considered a luxury in GA until fairly recently.

[TillE]

Plus the pilot stress of having to adjust to using dramatically different instruments when already in a difficult situation.

It's just not a workable idea in general. There are checklists for stuff like instrument failure which can probably recover from a software bug like this.

[caconym_]

It's absolutely a workable idea. Standby instruments are typically a requirement for glass cockpit aircraft, and before electronic standby instruments came onto the scene mechanical instruments were used in the standby role in (AFAIK) all sectors of aviation.

"Fly the airplane" is the highest priority in any aviation emergency, and in many emergencies you will need backup instruments to do so. I don't mean to be mean, but tbh it is a little absurd to suggest that a e.g. a pilot who loses her PFD in IMC is better off running checklists than using backup instruments to establish control of the aircraft and situational awareness, and bailing out asap. Sure, it's stressful, but it's also something pilots need to (and do) train for.

Once the aircraft is under control, you can run your checklists, or if you have a co-pilot you may be able to work in parallel. Maybe you will be able to fix the issue, and maybe you won't, but backups give you a shot at landing safely either way.

[sneak]

I think backups for the electronic systems would not need the same level of redundancy as the primary systems (which presumably already have backups).

It's sort of like how you don't need RAID for your offsite backup disks, just some parity for bit-rot.

The mechanical instruments would be the (additional) redundancy. The additional weight/lines/service is indeed burdensome even without redundant mechanical systems.

[mlindner]

> I think backups for the electronic systems would not need the same level of redundancy as the primary systems (which presumably already have backups).

If your backup is failing more often than your primary system then it's not much use as a backup.

Also, there ARE backups. There's fallback artificial horizon boxes that work independently of the rest of the system, for example.

[Teongot]

> Isn't it surprising that modulo arithmetic, as already employed successfully in TCP sequence numbers and the like, still seems to be incorrectly implemented today

Even in TCP sequence numbers, it can be implemented incorrectly.

https://engineering.skroutz.gr/blog/uncovering-a-24-year-old...