<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">When Brendan Hall (co-author on several “Byzantine really exists” papers) and I started reading about this incident, we correctly predicted that the recommended “fixes” would be of the type that would immeasurably reduce the probability
of occurrence but not deal with the underlying problem. Thus, after implementing the “fixes”, this problem can reoccur with insufficiently bounded probability. This is invariably the path followed those designers who don’t understand Byzantine.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">This is not the first time that an A330 has had a Byzantine failure among these components. Brendan recently found a report that included a description of a prior in-service Byzantine failure. But, the authors (and presumably all the
readers) of that report failed to recognize the Byzantine failure and so it wasn’t ever reported as such. When we get less swamped, we may write a paper on this, which would include a description of our work to create systematic knowledge-assisted design
process methods to identify vulnerable designs.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p style="margin:0in">> Kevin Driscoll has published a number of papers describing how the Boeing 777 flight control system was designed to avoid Byzantine failures.<o:p></o:p></p>
<p style="margin:0in">Actually, the B777 AIMS (cockpit system) we designed has full Byzantine coverage. Its flight control has only a mechanism similar to “signed messages” Byzantine agreement, which has less *<b>provable</b>* coverage. This was due to the
FCS designers discovering Byzantine too late in the design process and not having enough remaining spare data network bandwidth to do the full-exchange required. The B777 HEXAD inertial system uses an unconventional Byzantine failure recovery mechanism, not
yet reported in the literature.<o:p></o:p></p>
<p style="margin:0in"><o:p> </o:p></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b>From:</b> systemsafety <systemsafety-bounces@lists.techfak.uni-bielefeld.de>
<b>On Behalf Of </b>Dewi Daniels<br>
<b>Sent:</b> Friday, September 17, 2021 4:28 AM<br>
<b>To:</b> The System Safety List <systemsafety@lists.techfak.uni-bielefeld.de><br>
<b>Subject:</b> [External] [SystemSafety] A real-world Byzantine failure<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><br>
The Taiwan Transportation Safety Board has published the final report on a serious incident involving an Airbus A330. While landing at Taipei, all three flight control primary computers shut down, resulting in the spoilers, autobrake and engine thrust reversers
failing to operate. The aircraft stopped just 30 ft before the end of the runway.<o:p></o:p></p>
<div>
<p class="MsoNormal"><a href="https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ttsb.gov.tw%2Fenglish%2F18609%2F18610%2F26634%2Fpost&data=04%7C01%7Ckevin.driscoll%40honeywell.com%7Cfd8d5cce8eb04c2882f408d979bd73c1%7C96ece5269c7d48b08daf8b93c90a5d18%7C0%7C0%7C637674678207851847%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C2000&sdata=O3p%2BmKTFDriVhcB9fI10Q2EH9NnsGHosMqpkkxdWRBA%3D&reserved=0" target="_blank">https://www.ttsb.gov.tw/english/18609/18610/26634/post</a><o:p></o:p></p>
<div>
<div>
<p class="MsoNormal"><a href="https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ttsb.gov.tw%2Fmedia%2F4913%2Fci202_executive-summary_release.pdf&data=04%7C01%7Ckevin.driscoll%40honeywell.com%7Cfd8d5cce8eb04c2882f408d979bd73c1%7C96ece5269c7d48b08daf8b93c90a5d18%7C0%7C0%7C637674678207851847%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C2000&sdata=aPSH7NvHSt3p8X5MkRH00uePoYPZuOrM6HkRJoEB2UE%3D&reserved=0" target="_blank">https://www.ttsb.gov.tw/media/4913/ci202_executive-summary_release.pdf</a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><a href="https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ttsb.gov.tw%2Fmedia%2F4936%2Fci-202-final-report_english.pdf&data=04%7C01%7Ckevin.driscoll%40honeywell.com%7Cfd8d5cce8eb04c2882f408d979bd73c1%7C96ece5269c7d48b08daf8b93c90a5d18%7C0%7C0%7C637674678207861840%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C2000&sdata=%2BKCZzGhUpw%2FTF8ywpYee7J5hu6HW22llA4QpCDEMm2s%3D&reserved=0" target="_blank">https://www.ttsb.gov.tw/media/4936/ci-202-final-report_english.pdf</a><o:p></o:p></p>
</div>
<div>
<div>
<div>
<p><a name="m_1936185903109800707_SignatureSanitizer"><span style="font-size:10.0pt;font-family:"Arial",sans-serif">The report says that the flight control primary computers were shut down because the COM/MON pairs weren't synchronised closely enough. This
resulted in the COM and MON channels reading different input values and disagreeing with each other. This is claimed to be an unusual edge case that has not been seen before.</span></a><o:p></o:p></p>
<p>This is an instance of a well-known problem in computer science called the Byzantine Generals problem. Leslie Lamport's seminal paper presented a solution to the Byzantine Generals problem.<o:p></o:p></p>
<p><a href="https://nam12.safelinks.protection.outlook.com/?url=http%3A%2F%2Flamport.azurewebsites.net%2Fpubs%2Fpubs.html%23byz&data=04%7C01%7Ckevin.driscoll%40honeywell.com%7Cfd8d5cce8eb04c2882f408d979bd73c1%7C96ece5269c7d48b08daf8b93c90a5d18%7C0%7C0%7C637674678207861840%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C2000&sdata=5GqcUk3%2FXW7g7F3QdMhBHcGUmEbh9ZtqoWrQurb6Uog%3D&reserved=0" target="_blank">http://lamport.azurewebsites.net/pubs/pubs.html#byz</a><o:p></o:p></p>
<p>Kevin Driscoll has published a number of papers describing how the Boeing 777 flight control system was designed to avoid Byzantine failures.<o:p></o:p></p>
</div>
</div>
</div>
</div>
</div>
<p><a name="SignatureSanitizer_SafeHtmlFilter_UNIQUE"><span style="font-size:10.0pt;font-family:"Arial",sans-serif">Yours,</span></a><o:p></o:p></p>
<p><span style="font-size:10.0pt;font-family:"Arial",sans-serif">Dewi Daniels | Director | Software Safety Limited</span><o:p></o:p></p>
<p><span lang="FR" style="font-size:10.0pt;font-family:"Arial",sans-serif">Telephone +44 7968 837742 | Email <span style="color:purple"><a href="mailto:ddaniels@verocel.com" target="_blank">d</a><a href="mailto:ewi.daniels@software-safety.com" target="_blank">ewi.daniels@software-safety.com</a></span></span><o:p></o:p></p>
<p><span style="font-family:"Arial",sans-serif">Software Safety Limited is a company registered in England and Wales. Company number: 9390590. Registered office: Fairfield, 30F Bratton Road, West Ashton, Trowbridge</span><span style="font-size:12.0pt;font-family:"Arial",sans-serif">,
United Kingdom BA14 6AZ</span><o:p></o:p></p>
</div>
</body>
</html>