Config file wipe blunder caused deadly Airbus A400M crash – claim

The A400M isn't meant to replace the "aging" hercules. It sits at a point about half way between the herc and the C17 Globemaster, and is meant to fulfil a different role to both.

Assume human stupidity with computers...

... and plan accordingly

on error

I know nothing about these kind of systems but even cars have a "get you home" mode when a sensor fails. Surely that would only be a couple of extra lines of code.

I'm glad the code I work on will never kill anyone. At worse it'll lose a bit of money / reputation for the company, but that's it. Can't be nice for the guys who worked on this.

magnitude 7 or larger earthquakes tend to occur the same week as a large aircraft crash. I'm not sure how to make use of this information in a fail#safe check,

But it is a fact.

You would think that the first thing any critical system would do is validate any config files with a checksum, BEFORE allowing the software to continue booting....

the surprising thing is that theres not a safe-default fall-back setting

Shouldn't such a life-important software..

..check to make sure the config files are 1) there and 2) OK?

Seems to be the norm today ... assuming impossible things can't happen.

How much would it have cost on top of £13 million to have a buffer on the back of the roller coaster set? I'm sure a lot more examples can be found in this current 'cost cutting' marketplace?

Sad and Avoidable.

First, my sympathy and condolences to the families of those lost. Very sad.

I agree with several above, this should not have happened or happened on a simulator.

I call them dependencies. Every function, subroutine, class, whatever I write checks that anything needed external to the code block is both available and as much as possible valid. Input parameters/dependencies are checked for existence and sanity. Only then is processing allow to continue on to the primary function of the code block. Output/results, as much as possible, are checked for sanity as well. Much of this "overhead" can be kept in its own routine and knowing what is needed to be checked should already be in the initial design documentation before you write the first line. Perhaps too much bloat and time for systems that need to be super responsive but with todays CPU speeds, multiple cores, huge amounts of memory available dirt cheap I cannot imagine something managed by humans not having the spare 100mS needed to make sure of avoiding, wait for it old-timers.... Garbage in, Garbage out.

But I don't write code for airplanes. However I have often told a project manager they will get the code when it is ready and not before. This wins me few promotions or friends in management.

No fallback fault-tolerant option available?

Wut?

Airbus' track record on what happens when someone reports a technical risk

Since hearing the story of Airbus engineer Joe Mangan, I've always been relieved when finding I'm flying on some other brand of aircraft (although of course it might just be that they cover things up even better).

So if someone had spotted the fault, would they have dared report it?

Who makes the engine?

On reading the article my first thought was Who makes the engine?

A. Europrop International a consortium "Europe's four leading engine manufacturers: Industria de Turbo Propulsores (ITP), MTU Aero Engines, Rolls-Royce and Snecma Moteurs, the four partners of EPI."

So I wonder if a 'Committee' was involved or a translation problem!

Funny how Software – being “invisible” isn’t treated in the same way as stuff we can see – even by SW engineers. The config files are as critical to the aircraft as are the propellers. We can see the propellers “Oh, 3 props are missing, maybe we shouldn’t try a take off”. Are the config files there? Who knows? Let’s just go for it!

It’s the duty of the SW designers to make the critical items visible to the pilots – are the files there?, are they the ones you expect? – OK, next item on pre-flight checklist.

...I think their new number one priority is solvency.

FADEC

I'm surprised no-one has mentioned so far that this is the TP400 engine's second set of FADEC software. The A400M was intended and contracted to be certificated to civil standards, not just military, and for that to happen the software writing process had to be fully documented to EASA standards. The prototype A400M was getting close to initial testing when it dawned on someone that the TP400's FADEC hadn't been documented in this way, and was therefore uncertifiable. It had to be written again from scratch, following EASA procedures. That is probably the main reason the project is so far behind schedule. Yes, the A400M is 'overweight' and can't fulfil some of its initial contracted performance but this is not the show-stopper the FADEC debacle was.

It's funny Wikipedia makes no mention of this. There were plenty of reports about it in the pro aviation press at the time.

The computer games I play daily, have more safeguards than that jet. My game won't start without configuration files, and CRC checks on files.

Maybe EA should take over development (/joke).