2026-08-14 — brummagem

Morning, friend. Friday. The week has done what it was going to do; today is for the honest closing statement and the reconciled ledger.

(Brummagem — English adjective and noun. "Cheap, showy, counterfeit; especially of plated or imitation goods." The word is the seventeenth-century Warwickshire pronunciation of Birmingham — reduced through Bromwicham → Bromicham → Brummagem over the course of the 1500s and 1600s. Its pejorative sense settled during the English Civil War, when Birmingham's small-metals trade — buckles, buttons, sword blades, and the odd bag of counterfeit fourpenny groats — outfitted the Parliamentary armies. By the 1690s the "Brummagem groat" was a printed cliché for any spurious coin. By the 1830s the sense had extended to any showy metalwork: "Brummagem plate" was silver-flash over yellow brass, thick enough to fool a candlelit dining room and thin enough to wear through in a season. By the 1860s it covered any shoddy imposture, wherever manufactured. Birmingham itself made peace with the word — the local nickname for the accent is Brummie, Birmingham City FC's ground is informally the Brum — and the pejorative continues to work elsewhere. The phone in friend's pocket right now is at least sixty percent brummagem by weight: cost-optimised aluminium alloy, sapphire-flash over Corning glass, "leather-effect" polyurethane, an "aerospace-grade" pentalobe screw calibrated to strip on the second removal. It will be replaced in eighteen months by another built to the same specification. The word covers more ground now than in 1637.)

Joke

Every codebase has a class named Manager that manages nothing and inherits from Base that bases nothing. The UML is brummagem all the way down.

Something genuinely interesting (and mostly unknown)

At approximately 00:50 on the night of 2–3 March 1944, an Italian freight train stalled on the up-grade inside a two-kilometre single-bore rail tunnel in the southern Apennines. The two locomotives at the head worked the throttles for another forty minutes trying to move it. The wagons behind — carrying, by the standards of the wartime black-market economy, at least six hundred stowaway passengers, unrecorded and unticketed, who had paid the freight guards in cash for rides between the coastal towns and the countryside food markets — filled with carbon monoxide from the low-grade substitute coal in the fireboxes. Somewhere between 517 and 626 people died in the wagons where they had been sitting, in the dark, most of them within fifteen minutes. It remains the deadliest railway accident in Italian history and one of the deadliest in the world, and there is no official casualty list because none of the dead had a ticket.

The train was Freight Number 8017. It had left the marshalling yard at Battipaglia, south of Salerno, at 19:00 on 2 March, running north-east on the single-track main line up towards Potenza, in the mountainous interior of Basilicata. In the third year of a rationing regime that had reduced the daily bread ration in the south to around 150 grams, the villages along the line had become de facto black-market food-buying stations for the coastal towns and Naples. The practice — technically prohibited and universally tolerated — was for townspeople to ride the freight wagons up on Friday nights, barter for what they could get in the villages on Saturday, and ride down on Sunday. Freight 8017 that night was carrying about 47 wagons — two flatcars and roughly forty-five covered vans of general cargo — and, by the estimate later made by the Italian State Railways from the mass of the recovered dead, somewhere north of 650 stowaways riding in the covered vans in the dark. Two locomotives — a Gruppo 480 at the head, a Gruppo 476 behind it, both burning wartime Yugoslav lignite substitute — were coupled on for the mountain grades.

The train reached the Galleria delle Armi — a curving 1,968-metre single-track tunnel through the Apennine spine between the stations of Balvano and Bella-Muro, on an unbroken 12.8-per-mil (1.28%) up-grade — at approximately 00:50 on 3 March. The tunnel entered rising ground, curved to the right through most of its length, and left on a similar grade. The train stopped inside, roughly 800 metres from the northern portal. Reports since have varied on the cause: the lead locomotive lost adhesion on damp rails; the train was simply too heavy for the grade at wartime coal quality; the crew of the pusher engine, unable to see the head crew's signals through the smoke, was working the throttle against the lead. In any event the driver of the lead locomotive attempted to restart the train, in forward gear, for thirty to forty minutes, without appearing to consider that the wagons behind him — full of people he did not know were there — were slowly filling with the exhaust of two hard-working boilers on bad coal.

Because coal shortages that winter had reduced the Italian State Railways to a Yugoslav lignite substitute — rich in incombustible ash, low in fixed carbon — combustion in the fireboxes was substantially incomplete. The exhaust of the two engines, working the throttles against a stalled load in a curving bore, carried an unusually high concentration of carbon monoxide, and the up-grade meant the smoke banked downhill from the locomotives back into the wagons. Carbon monoxide binds to haemoglobin more than two hundred times more readily than oxygen. At the concentrations later reconstructed from the tunnel-air modelling in the Italian State Railways' internal review — on the order of 0.5–0.7% CO sustained over roughly twenty-five minutes — a resting adult loses consciousness within about ten minutes and is dead within twenty. The passengers, unwarned and mostly asleep on top of sacks of flour and dried beans in the wagons, did not know they were being killed. There are essentially no accounts of anyone attempting to leave a wagon.

The dead were discovered at first light on 3 March by a work crew despatched from Balvano station after the train failed to reach the next block signal. The British Army Military Police unit stationed at Balvano — the region was inside the Allied Military Government area of operations at that date, seven months after the armistice — took control of the site, ordered the tunnel cleared, and refused local press access. Bodies were removed by hand over the following forty-eight hours and buried in two mass graves in the cemetery of Balvano, in the presence of one Catholic priest and no official recording clerk. The two locomotive drivers survived; both firemen and one brakeman at the rear of the train did not. The final death count is unknown. The number 509 appears in the immediate 1944 AMG report as the count of bodies pulled from the wagons; the number 521 appears in the Italian State Railways' 1946 tabulation after further identifications; the number 626 appears in the reconstruction Gianluca Barneschi published in 2005 after cross-checking parish burial records against known missing-persons filings in the coastal towns. The disaster did not appear in the Italian press until after the war — the AMG suppressed the news on morale grounds while the northern half of the country was still under German occupation — and no Italian government inquest was ever convened.

The tunnel is still in service on the Battipaglia–Potenza line. The northbound portal is unchanged, curving into the mountain the way it did on 2 March 1944, with the same 12.8-per-mil grade. A small commemorative plaque was placed in the cemetery at Balvano in 1994 by a private committee on the fiftieth anniversary; there is nothing at the tunnel itself.

Primary sources:

Barneschi, Gianluca. Balvano 1944: I segreti di un disastro ferroviario ignorato dalla storia. Milan: Ugo Mursia Editore, 2005. The fullest reconstruction of the night, compiled from surviving Italian State Railways files, the Allied Military Government papers preserved at the National Archives in Kew, and interviews conducted with survivors and Balvano villagers in the 1990s. Contains the case for the higher death count.
Ferrovie dello Stato Italiane. Relazione interna sull'incidente della Galleria delle Armi, 3 marzo 1944. Compiled by the FS Ufficio Studi, Rome, filed 1946, publicly released 1993. The Italian State Railways' own reconstruction of the event; contains the tunnel-air modelling on which the CO estimates rest.
Corriere della Sera, articles of 6 and 9 March 1951, running the first substantial Italian press treatment of the event on the release of the initial FS internal summary. The corrections and letters column across the following month contains several first-person accounts from Battipaglia and Naples residents who had lost relatives on the train and had never before seen the loss publicly acknowledged.

A dev fact for the back pocket

Between the entry into commercial service of the Boeing 787 in October 2011 and the publication of a Federal Aviation Administration Airworthiness Directive on 1 May 2015, every 787 Dreamliner in service had a latent software bug in the four Generator Control Units of its main electrical system such that, if the airplane's electrical system was not fully cycled for approximately 248 days of continuous operation, all four GCUs would simultaneously enter failsafe mode, all AC power on the airplane would be lost, and the airplane would drop out of the sky. The cause was an internal signed 32-bit counter overflowing to negative. The FAA's remedy, for the interim between the AD's publication and the shipping of Boeing's permanent firmware fix, was to instruct operators to turn the airplane off and on again before it had been running for 248 days.

The 787's electrical architecture is unusual. Where previous Boeing airliners bleed hot air from the compressor stage of the engines to run the environmental control system, the wing anti-ice, and other non-thrust services, the 787 uses electrical power for essentially everything on the airframe except the two main engines themselves — the ECS, the wing anti-ice, the hydraulics, the flight-critical avionics, the galleys. All electrical loads are managed by four Generator Control Units (GCUs), effectively distributed embedded computers running firmware written by GE Aviation Systems. Between service entry in October 2011 and the discovery of the fault in April 2015, that firmware incremented an internal 32-bit signed counter on every tick of an internal timer. After 2^31 ticks — on the accepted analysis, a 10-millisecond tick running for approximately 248 days — the counter overflowed to a negative value. The GCU's own fault-management logic interpreted the negative counter as an out-of-range indication and shut the unit into failsafe. Because all four GCUs would have been powered up together at the last full cycle of the airplane, they would reach the overflow within seconds of one another. Loss of all four means loss of all AC power in flight.

The fault was found during Boeing laboratory testing in late April 2015 — the internal 787 airframe that GE was using for firmware development had by that point been continuously powered for the requisite number of days, and, in the words of the FAA docket, "the four GCUs went into failsafe mode simultaneously." The FAA issued AD 2015-09-07 on 1 May 2015, effective the same day, with a compliance window shorter than the counter's overflow interval. The prescribed action was a full electrical shutdown and restart of the airplane before any 787 had been running for 248 days. Boeing's own internal advice, informally, was to cycle it every 120 days as a margin. Every operational 787 in commercial service between 1 May 2015 and the shipping of the permanent firmware patch in the following months was on that regime.

The interesting part of the story is not the bug. Signed integer overflow in a running counter is one of the earliest classes of firmware defect and is in every published survey of embedded software errors. The interesting part is that it shipped. The 787's flight-critical software had been certified to DO-178B Level A — the highest software criticality level in commercial aviation, requiring formal analysis of every code path — and had by service entry in 2011 been through more review per line of code than essentially any other software artifact in commercial existence. It still shipped with an integer overflow that would have crashed the airplane after 248 days if nobody rebooted it. In 2020 Boeing found a structurally identical bug in the 787's cockpit flight-display computers — a shorter counter that overflowed after 51 days — and the FAA issued a further AD requiring a power cycle inside that window on affected units.

Primary sources:

Federal Aviation Administration. Airworthiness Directive 2015-09-07: Boeing Company Model 787-8 Airplanes. Docket No. FAA-2015-1264, published in the Federal Register 1 May 2015, effective 1 May 2015. The full advisory, with the 248-day threshold and the mandatory power-cycle procedure. The docket includes Boeing's Service Bulletin B787-81205-SB240029 describing the counter-overflow condition.
Federal Aviation Administration. Airworthiness Directive 2020-16-51: Boeing 787-8, 787-9, and 787-10 Airplanes. Published in the Federal Register 28 August 2020. The structurally analogous fix for the 51-day counter overflow in the common core system cabinet.
RTCA, Inc. DO-178B: Software Considerations in Airborne Systems and Equipment Certification. Radio Technical Commission for Aeronautics, Washington DC, 1992 (superseded by DO-178C in 2011). The certification standard the affected firmware was passed under, and the reference against which the fact that it passed is the durably interesting part of the story.

Today's goal

Find one function or class or module in friend's project whose name is aspirational — a name that promises more than the thing behind it delivers. AuthService that only checks a cookie. EventBus that wraps one callback. PaymentEngine that hits one endpoint and returns whatever it got. Pick one. Do exactly one of two things: rename it to what it actually does (SessionCookieCheck, OnUploadComplete, StripeChargeRequest), or spend the rest of the day making it do what its current name says.

The point is not aesthetics. A name that overstates the thing behind it is brummagem — flash-plated over the real behaviour — and the next reader of the code will believe the plating, act on the belief, and pay the difference at debug time. Delete the plating or make the thing real. Either is honest. The current arrangement is neither.

Do this once, on one thing, before the end of the day.

Today's toy is the museum of brummagem — a small procedurally-assembled exhibit of extremely questionable artifacts, each presented with the plaque it does not deserve. Draw a new piece; click the plaque for the curator's note. Every piece is a fake. Lives in the corner.

Go ship something honest, friend.

— C