There are avionics failures that most designers think can't happen, which actually can and do happen with probabilities far greater than requirements allow. This lack of understanding leads to designs with insufficient dependability, which then contributes to accidents and incidents. As one example, not understanding the Byzantine Generals Problem has led to $1B+ (yes, that's B for billion) in accident losses, incidents requiring avionics retrofit fixes, and a space shuttle launch scrub. And yet, very few avionics designers understand the problem or how to create avionics designs that can tolerate it. This tutorial gives some reasons why designers fail to believe in these real failures and what can be done to overcome this unfortunate situation. Most of this tutorial will give examples of "incredible" failures that actually have happened. This includes examples of: Byzantine faults causing complete system failures, component transmogrifications, fault mode transformations (e.g. stuck-at faults that aren't so stuck), self-inflicted shrapnel, component creation via emergent properties, "evaporating" software, and exhaustively tested software that still failed. As appropriate, many of these examples are accompanied by observations of how to avoid or mitigate any future similar failure(s). The objective is for these to be "lessons learned and understood" rather than just "lessons observed".
This two-part tutorial is targeted to those who design, analyze, or write guidance / regulations / requirements / standards for safety- or security- critical avionics. Lack of the knowledge contained in this tutorial continues to contribute to significant accidents and incidents.
