Crashing an in-flight entertainment system

Algorithms are definitive. Programs are frequently inaccurate.

An interesting case of breaking a system comes from Hugh Thompson, who managed to crash a inflight entertainment (IFE) system on a flight from Las Vegas to Orlando in 2005. Most modern aircraft have entertainment systems built into the head rest of the chair in front through which passengers can watch TV shows, movies and play games. The system in question had a game of Tetris which had the option of modifying the number of blocks shown in advance before they start falling. Hugh pressed to + control to a maximum value of 4. Now thinking outside the box, he wondered if there were any other means by which to change the value. A small phone console in the arm rest proved to contain a numeric keypad which controlled the TV monitor. Trying various combinations of numbers: 10, 8 he had no luck. Then trying the value 5, the number of blocks changed. 5 is considered a boundary value, just beyond the maximum allowed for the field, 4. This is a classic off-by-one error often encountered when performing operations on structures such as arrays, or using loops. Now, hitting the + button on the screen, the value actually incremented to 6.

Likely the code was of the form:

keypressed(k);
if (k == "+" && (0 < nblocks && nblocks != 4))
    nblocks = nblocks + 1;

This would allow the number of blocks to be incremented if its value was 0 to 3. Once its value was 4, it would no longer increment. Because nblocks had been changed to 5, the expression holds true, so its value would be incremented. Hugh continued to increment the value until it was 127. 127 is the upper bound of a signed char, so that when the + key is pressed again, in all likelihood the value of nblocks will change to -128. Pausing for a moment to consider this, Hugh proceeded to press the + key once more, the display flashes -128 for an instant and then the screen goes black. Actually every screen in the plane, and the entire entertainment system crashed. A simple logic error.

Crashing in-flight entertainment systems has always been relatively easy – partially because they aren’t built very well.   Generally when one node crashes, the entire system is taken down. This may be due to a lack of testing in a real-time environment. This is however slowly changing as IFE systems become more in vogue. Boeing recently tested the IFE system in their 787 Dreamliner by having 250 employees play with the system on a 7-hour flight. The ultimate in real-world testing! Some airlines such as Hawaiian Airlines are debuting the use of iPads for their inflight entertainment – circumventing the need for proprietary IFE systems all together.

Advertisements

One thought on “Crashing an in-flight entertainment system

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s