Ethernet failure on Swiss business jet prompted emergency descent, say aviation safety bods An Ethernet failure aboard popular Swiss-made business jets could prompt the aircraft to move into an emergency descent as flight systems entered a "degraded" mode, the European Aviation Safety Agency (EASA) has warned. In a recently issued airworthiness directive, EASA has ordered operators of the Pilatus PC-24 to install new …
Fly-by-wire - where everything is hooked to a computer - is not something new. F-16's have been flying like this for, what, 40 years now?
What's new is not having a McDonnel - Douglas level of budget to exhaustively test everything or having the DoD breathing down your neck to QA the bloody thing properly because you are going to wage war with it.
Trusting your life to a router ain't exactly a good thing, unless you built it for this purpose with infinite budget... so it works right off the bat, and you don't have to wait WINDOWS UPDATE to deploy the landing gear or lower flaps!
You don't need an infinite bucket.
You can get certifiable (i.e. all the certification artefacts are already packaged and can be bought) network and compute systems as COTS (common off the shelf) products, if you go to the correct supplier.
As the aircraft manufacturer, it is then up to you to include this in the aircraft certification.
This post has been deleted by its author
For sure, I feel a lot safer on the M25 than US101, even in the Suburban
Not if Highways England rollout more SMARTDUMB Motorways
This post has been deleted by its author
This isn't trusting your life to a router though, these are all systems that make the flight more comfortable for the passengers, and easier for the pilot, but the plane can (and did) continue to fly without any of it working. The "emergency descent" mentioned will have been to bring the aircraft down to a height where there is enough oxygen in case the cabin pressure gets compromised, which is standard practice and would be carried out by the pilot in an emergency if the autopilot didn't do it. This incident is equivalent to the climate control, power steering, and traction control in your car turning off, rather than the engine cutting out.
From the description of the incident, no one was ever in any danger, but they would be considerably less comfortable, and would immediately get the situation checked out (in the same way you would with an electrical fault in your car).
I'd also argue that I've had my brake vacuum assist "turn off" in may car (due to another small vacuum hose splitting at the end and starting to leak badly), and let me tell you the only reason I didn't full on crash into the vehicle in front of me when it happened was that I tend to drive hella cautiously. I defo did skip a beat though seeing as how the effect can best be described as "step on the brakes and nothing whatsoever happens" even though technically they do still work, you just have to apply roughly 10Gs worth of your body weight on them to do what they did before. So I'm sorry, no, modern "luxuries" in a car are NOT, in fact, luxuries.
This applies to the F16 and virtually every military aircraft developed since. They are dynamically unstable in all 3 axes and would not be able to fly without FBW. If you watch an aircraft such as an F16 or F18 doing a high angle of attack slow pass at an airshow you can see all the control services constantly moving under the control of the FBW system.
One of the early F117 "Wobbly Goblins" crashed due to incorrect information being fed to the FBW system. Basically took off, then threw itself at the ground and failed to miss.
I'm sure the DoD's QA is excellent, but you'd hope the standards for civilian aircraft would be orders of magnitude better, not worse.
F-16s don't have to carry passengers, and the pilot knows they're signing up for a certain risk of death when they take the job. Though they do have the means to descend safely to earth without the aircraft, which is a nice reassurance to have.
People would rightly have conniptions if 15% of all 737s ever built had crashed, but that's par for the course for a lot of fighter aircraft, including the F-16.
I used to supply these to various air frame integrators.
I was rather taken aback when it just popped up in conversation that aboard a major new large aircraft (think Jumbo jet size, but not suggesting any particular manufacturer) as part of their flight trials, they had removed the flight control network switch(es) in flight and swapped for other units they had at hand.
They have bigger dangly bits that I have!!!
My personal feeling is that anything that can be flown manually should have a total overide system, so that in the event of a hijack by gremlins, the pilot/s can take full control of the aircraft.
Pilots ought to be considered a significant part of the redundancy rather than simply redundant.
It is not a flaw, an "emergency descent" is not a dive into the ground, it is a relatively rapid but controlled descent to 10000ft or below. There are not many mountains above that height, and flying over them requires specific procedures and permissions, which will include amended emergency descent procedures if required.
It is almost like the people who design aircraft and their procedures know more about these problems than commentators on IT forums :D
If something happens that either does or is likely to result in the loss of cabin pressure, you dive to 10k feet (unless terrain).
This is because the emergency oxygen supply doesn't last very long, and you need to be in breathable outside air before it runs out.
So it's basically an automatic pilot response to their oxygen masks deploying.
If your mask pops out of the ceiling, you put it on and start the emergency descent. You don't ask why it happened until you're down at a safe flight level.
Well I'm not a genius but I can't see anything in the article to suggest that is what it's fixing.
I assume the software update is about stopping the Ethernet borking itself. A bit like the 50-odd day recycle needed in some passenger jets to 'turn it off and on again' and prevent it crashing (in the IT sense of the word).
Boltar summarised:
"emergency descent will no longer happen upon network failure."
Seems like a perfectly reasonable fix as stated. Got any pointers to further info?
That said, it does suggest that more than one person/organisation may have made a pretty poor job of any Failure Mode and Effects/Criticality Analysis that may or may not have been conducted, supervised, reviewed, and approved.
(Been there, seen that, no longer in the industry)
You keep assuming the network failure is a hardware failure.
I do not understand why you think that is the case, the article even links to a previous story where the power cycling of an aircraft was required to stop the internal network from crashing (as I suggested originally).
It really isn't that difficult a concept.
"It is almost like the people who design aircraft and their procedures know more about these problems than commentators on IT forums :D"
Downvoted you as sadly this statement is no longer true 100% of the time. I would imagine many of the commentators here would appreciate the value of sensor redundancy more than apparently Boeing did!!
One reason (but not the only one) for fly by wire is that the aerodynamic forces just get beyond human muscles. See the comments about the 787 Max trim wheel.
Most fly-by-wire systems still rely on hydraulics as the actuators. Older non-fly-by-wire aircraft often had cables running from the controls to the hydraulics actuators, so the weight saving is probably less than you'd think.
NB you can undoubtedly find exceptions to both those statements.
DC-9 in particular has control tabs (operated directly by the yoke and pedals) for all primary flight controls. The rudder is hydraulically powered, but will fall back to tabs automatically if lost. Also has a hydraulic pusher for the elevators that would be used when trying to recover from high AoA situations where airflow might be insufficient to allow the control tabs to move the elevators properly. It is a very 'analog' plane by today's standards.
To elaborate, control tabs are a smaller control surface that moves opposite the desired control deflection, and basically fly the control surface into position. As their effectiveness increases with speed (up to a point), controls remain reasonably light on a smaller aircraft.
For more details on this and secondary flight controls (flaps and spoilers are also hydraulic), see http://www.hilmerby.com/dc9/flap.html
- I had originally written in 'servo tab', but that is a related concept used to reduce control forces on otherwise directly linked surfaces... on DC-9, the control tabs are the only thing linked directly to the controls.
Beyond human muscles is why servo systems like power steering were invented, although they can be operated by fly by wire they can also be operated by a pilot, so as I said anything that can be operated by a pilot should have an override so that in the event of Fly by wire/AI failure a meatbag can take over.
I'm only being slightly flippant but it depends on the human. I'm not saying pilots should hit the weights every day but your regular weights user is probably 50-100% stronger than Mr Average which could make a big difference in this sort of scenario. Perhaps there should be a minimum fitness/strength level for pilots as well as a medical checklist.
That's less typical than the front falling off, I'd just like to make that point.
It mentions a dual-channel Ethernet device.
Of all the people in the frikkin' world who ought to know that dual-channel redundancy means dual hardware kit, it ought to be aircraft systems designers.
This is the kind of idiocy that lights up the BOFH's choice of next candidate for the open window. And at 30,000 ft that strikes me as not a bad idea.
How widespread is this practice?
Speechless!
"How widespread is this practice?"
AFDX/ARINC664 are common as muck and have been for a decade or more.
There are a few bits and pieces which distinguish real AFDX/ARINC664 from an average Ethernet switch.
If there's a more detailed writeup (root cause anlaysis etc) of what went wrong (other than calling an aircraft a PC!?), I'd be interested to see it.
"“AFDX”/ARINC-664 Part 7, or “Avionics Full Duplex Switched Ethernet”" is remarkably similar to dual-link UDP over a pair of classical switched Ethernets, and has been for a few years. Indistinguishable, in some circumstances.
I've even seen High Street network gear used (on the ground, for test/experimental purposes) when the real thing was temporarily unavailable.
However, there are some real differences (or used to be) such as hardware-enforced bandwidth limits, and when it's deployed in a real aircraft, you might expect it to be the dedicated flight-standard real thing, not the PC World/D-Link/Netgear/etc version.
The fact that the Airworthiness Directive references Ethernet rather than AFDX or ARINC664 is interesting. Yes I've looked at the source as well as the article. Maybe there was a time when EASA would have been more careful with terminology. Or maybe I'm misremembering - this 2008 article calls it out as Ethernet too:
https://www.aviationtoday.com/2008/10/01/deterministic-ethernet-for-avionics/
"ARINC Specification 664 Part 7 defines AFDX. AFDX takes existing Ethernet physical layer technology and, using switched Ethernet in full-duplex mode as a basis, adds deterministic packet delivery, and high-integrity and high-availability mechanisms."
People have raised some issues with my sensible suggestion about IP over pigeon. But I think they've neglected a few factors.
Firstly most data is transmitted from cockpit to the planes control surfaces. Well if the plane is doing say 400kts then the pigeons simply need to leave the cockpit and wait for a second or two, and the tail elevator or wing slats will reach them with hardly any effort required at all. I suppose a harsh person might suggest that this is only a form of broadcasting, rather than networking.
But I would argue that the energy saving on the trip down-plane, would leave them fit for the much less important trips back up-plane - back to the cockpit with any required sensor data.
Chickens can climb ladders in order to get into their coops. This being a basic anti-fox defence. Well I don't see why pigeons couldn't manage the same feat. Then you'd simply need to install a few so they could get into the passenger or baggage cabin and then flying up-plane would be simple.
Plus we now have various relightable solid rocket boosters available, should they require a quick burst of speed - such as if they need to communicate an engine fire. But in the main I think we should encourage a slower pace of life - and I'm sure the pilots will discover if the undercarriage has deployed or not once they put the plane on the runway.
When we first started getting local networks at my former employer, I worked in an IT shop in Finance. We wanted to get ethernet, since our new hire network people had a background in ethernet, and it was much cheaper. However, the main IT area was all mainframe people who basically did what IBM told them to do, and they set a companywide requirement to use token ring. We subsequently found out that the regional offices, who were our primary customers and were also profit centers, had all ignored the requirement and installed ethernet, making application troubleshooting interesting if there was a network problem, since we had token ring and central IT wouldn't support ethernet.
Eventually, central IT changed to use ethernet, and hired our network people away from us. Interesting times!
I did notice your icon, Token Ring was physical when I had something to do with it, long ago. Some companies had to let go of some of their lifts just to be able to pull all those wires from floor to floor, and I think there was some joke in London about the Exchange, did the building support all the wire or was it the opposite way.
Token Ring does degrade gracefully but its got appalling throughput compared to Ethernet, its expensive and relatively few people understand it. It was on of those 'seemed like a good idea at the time' jobs.
There is another class of networking that many people -- even those that work with data networks -- are unaware of. These are industrial networking technologies, and one popular one has a passing resemblance to Token Ring. Its also used by Airbus -- at least they're members of the technology group. This type of networking -- EtherCAT -- is built on Ethernet physical layer equipment and (superficially) Ethernet format traffic but all the stations are connected in a ring. It differs from 'pure' Token Ring type networks in that there is no circulating token or MAC level protocol to manage and throw a token -- all traffic originates from and terminates on a 'master'. This type of network is designed to be reliable, potentially redundant, to fail in a predictable manner and can support syncronized data transfers to a precision of a microsecond or better.
Yeah, well, they would have, but the additional weight of the TYPE 1 cables, connectors and hubs made the airplane too heavy to fly. Also, there was no room left for luggage or passengers.
// Token Ring sucks
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
