Sign in / up

back to article Software bug fingered as cause of Aussie A330 plunge

The final report into the 2008 Qantas flight QF72, which unexpectedly dived twice during a routine flight, has blamed a combination of software and hardware errors for the incident. On 7 October 2008, the Australian-owned A330-303 aircraft was cruising at 37,000 feet when the autopilot disengaged and the aircraft rose, before …

COMMENTS

House rules Send corrections
This topic is closed for new posts.

Page:

  1. Anonymous Coward
    Anonymous Coward

    Airbus apologists unite!

    it's time for all the "Air France pilots were inadequately trained" people to come to the front about how the Airbus command and control system only fails when the pilots screw up...

    and the rest of us can point fingers in derision.

    Airbus: the best civilian aircraft the Consortium can force you to buy. It's BAE lite!

    2 22
    1. Aaron Em
      Reply Icon

      Hah! Made it!

      I'd point out that the claim isn't and never has been that the Airbus A330's fly-by-wire system never screws up, but only a gibbering twat would actually need that explained, and there's certainly none of those around here, are there?

      5 1
    2. Lars Silver badge
      Reply Icon
      Coat

      Re:Airbus apologists unite

      I am not sure I got you right but that box is clearly made by Northrop Grumman not by Airbus, Air France or BAE.

      8 0
    3. Matt Bryant Silver badge
      Reply Icon
      FAIL

      RE: Airbus apologists unite!

      "it's time for all the "Air France pilots were inadequately trained" people...." An amazing display of ignorance and prejudice. The investigation showed that the Flight 447 flight computer was stymied by frozen speed sensors and so switched off the autopilot. It was then the inexperienced copilot that stalled the jet into the sea after taking manual control.

      3 1
    4. Intractable Potsherd
      Reply Icon
      Trollface

      @AC

      I think you'll find that most people here thought that it was combination of the two - AF447 was the victim of some rather silly decisions regarding the control of the plane, made worse by two loons that shouldn't have been let loose with a child's kite.

      < < Appropriate icon for you, I think.

      0 0
  2. Aaron Em

    In (possibly) before claims

    that this is a clear exoneration of Air France 447's flight deck crew -- it isn't.

    6 2
  3. Destroy All Monsters Silver badge
    Holmes

    Is that a WinXP license sticker on the black box?

    Seriously chaps, good work. Tell the machine who's boss. Humans have even higher redundancy than 3 built-in, but are slower. Sometimes it's advantageous. Additionally, good design that is both highly automated and allows manual overrides that make sense.

    Also passengers: Keep your seatbelt on, if only for insurance claims - should you survive.

    8 5
  4. Error Message Silver badge
    Holmes

    Well duh...

    "It’s not clear what caused the ADIRU to shift into failure mode, as this is only the third time that it has happened in over 128 million hours of operation – although one of those other incidents was down to the same ADIRU in that aircraft."

    Take that specific ADIRU out of the aircraft!!

    16 0
    1. ArmanX
      Reply Icon

      That was my thought.

      If units fail that rarely, it may be in the best interest of both the passengers and the company to simply replace the unit with a new one.

      If we start with the assumption that a repaired unit has the same integrity as a new unit, the chances of a unit failing twice is very slim. If it does fail twice, then statistically, either the unit is bad, or the computer reading it is bad (it may come down to bad shielding around that 'slot').

      Since intermittent failures are nearly impossible to diagnose in some cases, I think it would be safer to replace the device altogether, rather than continue to fly with it. Intermittent faults are annoying when it involves an X-Box or a cell phone, but on an aircraft? Just junk it, and get a new one.

      5 0
      1. Fatman
        Reply Icon
        FAIL

        RE: Just junk it, and get a new one.

        From a logical perspective, with its questionable reliability; I would be hesitant to allow it to remain in service.

        2 0
      2. Anonymous Coward
        Reply Icon
        Anonymous Coward

        Or just RMA the unit.

        Worst case, return the whole unit to AirBus - airframe et al.

        2 1
      3. FredScummer
        Reply Icon

        > If it does fail twice

        If it fails, or is suspected of failing, just once then I'd be up for swapping that unit out for a new one. After all, it's a simple bolt-on box, it's not as if you would have to tear the plane apart to replace it.

        Waiting for a unit to fail again amounts to gambling in my book. Someone in the supply chain was thinking "profit" before "danger" with that earlier decision.

        2 0
        1. Yag
          Reply Icon

          Mmmh...

          The usual procedure for such failure is a return to the supplier, for extended analysis and tries to reproduce the problem. Don't forget that "software issues" will be applicable to ALL the equipment of the same model...

          No one on the supply chain was thinking "profit", the unit was probably already returned, and the problem could not be reproduced - hence could not be fixed. It happens most of the time...

          And as the price of such units is quite hefty (High dev costs and low volumes usually have this kind of effect), the decision to trash the unit is rarely an option. The worst cas for reluctant hardware is to end their life as "not for flight" bench bitch.

          1 0
      4. Matt Bryant Silver badge
        Reply Icon
        Boffin

        RE: That was my thought.

        Two problems with just swapping the unit - firstly, you're not definately curing the problem; and secondly, the beancounters.

        You are not curing the problem as you have not confirmed the unit is the definate cause of the problem. As mentioned, it could be shielding around the slot it plugs into, or an intermittant short or earth in the loom connecting the unit to the main system. To find the actual cause would involve a lot more testing of all the variables (like running the suspect unit in other slots to see if the problem moves with the unit or affects a "good" unit in the same slot).

        Unfortunately, the beancounters are also not going to allow you to find the real cause. If you ask to remove the unit, the beancounters will simply say "no, it's expensive, if it passes diagnostics then slap it back in". If you ask for more time to find the real cause of the problem then the beancounters will point out the aircraft is needed to meet flight schedules. At the end of the day, we need more control for the authorities to step in and say that if an aircraft has a serious issue inflight, it is grounded until the definitive cause is found and fixed. If the definitive cause cannot be found, ALL possible items that could have been at fault have to be replaced (eg, AIRDUS, slot and loom).

        2 1
        1. Anonymous Coward
          Reply Icon
          Anonymous Coward

          I have been an avionics technician in the Air Force (US) and for a commercial airline. I have never ran into a condition where I couldn't R&R a black box for any reason other than that a replacement box wasn't available. Intermittent problems are a BITCH for a couple of reasons; one has already been mentioned, it might not be the box that is causing the problem; another is that when a box with an intermittent problem goes in for repair, the chances are very good that no trouble will be found with the box; firmware might be upgraded, mods might be applied, it will be tested, cleaned, and put back in stock. The biggest problem in cases like in this article, with intermittent problems that occur very rarely, you have no idea if the new box fixed the problem.

          2 0
          1. FredScummer
            Reply Icon

            I hear all of the arguments about replacing this box, including "bean counters". However bean counters usually get persuaded by arguments involving loss of life and planes falling out of the sky - tends to be a bit more costly when that happens. I cannot imagine a bean counter saying no if his future depended upon making sure the airline was robustly protected against serious outages.

            Connection issues: Really? Sounds pretty doubtful to me if the connectivity relies upon simple pressure fittings between components. I would expect every connection within and without the box to be clamped, with no margin for "iffy" connections.

            With regard to swap-out, given the cost of these devices I would reasonably expect both the airline and the supplier to have worked out a support option on the contract which provides a hot-swap on demand. Presumably the original supply contract was for a few dozen units - and I would reasonably expect any competent supplier to add a few more to the quantity for build purposes.

            And as for identifying which unit - a possible contender obviously, however under the circumstances I'd be up for swapping everything which could have played a part. As a hardware engineer (not with avionics) I have been in the situation where I swapped everything which could have been a cause. I never had a problem with a bean-counter declaring I had gone overboard, I was the on-site guy with responsibility for keeping the customer working and what I said was never questioned. Okay, most times I didn't swap everything, but it was always an option.

            1 0
    2. Dagg Silver badge
      Reply Icon
      Boffin

      VLF submarine communications station

      Just outside of Learmonth 6 km from Exemouth is a high powered VLF submarine communications station (Naval Communication Station Harold E. Holt). I've seen the aerial farm and it is huge. It is extremely interesting that the aircraft was flight over it at the time of the failure.

      They stated that it didn't appear that any passengers were using any electronic equipment but you have to wonder about interference from the communication station.

      This is not the first time this has happened over this area check out

      http://en.wikipedia.org/wiki/Naval_Communication_Station_Harold_E._Holt

      0 1
  5. Tim of the Win
    Alert

    More complicated systems = more complicated problems

    10 0

  6. This post has been deleted by its author

    1. Gordon 10
      Reply Icon

      You utter muppet.

      I suggest you go and research the number of safety incidents with autopilot on vs those with autopilot off.

      Then come back here and resume your meaningless pontificating if you dare.

      You do realise how stastically insignificant this event was don't you but rather than strap the 60 morons in their seats you would rather endanger millions more by not trusting systems that are far less fallible than the meat puppets they replace.

      You do realise yours is the same kind of ill informed opinion that make our politicians come up with dozens of knee jerk legislative and executive decisions every year right?

      48 5
      1. Anonymous Coward
        Reply Icon
        Anonymous Coward

        "I suggest you go and research the number of safety incidents with autopilot on vs those with autopilot off."

        While, on average, the computer control is safer, you won't find the average human pilot aiming the plane at the ground and thinking its ok.

        People say computer control in cars will make them safer as they can override human decision. What about the times where the human decision is the right one? Doing an emergency stop on a busy motorway wont be fun.

        4 12
        1. The First Dave
          Reply Icon

          @AC

          The things is, that is (apparently) exactly what happened with the Air France crash over the Atlantic - the co-pilot actually pointed the plane at the heavens, but the effect was the same as pointing it at the sea.

          11 0
          1. hans-peter carpenter
            Reply Icon
            Boffin

            Last Dave

            Out of which cavern have you come ? Please, when you do not know what you are talking about, please, shut up. The crash of the Air France flight over the Atlantic, aka AF447 was due to the pilots, not the aircraft - despite the fact that some equipment was not functionning 100%.

            The aircraft stalled, was losing altitude, yet the pilots kept pulling the joystick iso pushing it to gain lift. The auto-pilot was not engaged during the time of the incident ... so yes, you are right, they were pulling the joystick and were going downwards ... all because they had no lift ... pilots were idiots like you, I guess !

            0 1
        2. Matt Bryant Silver badge
          Reply Icon
          Pirate

          RE: AC

          "....While, on average, the computer control is safer, you won't find the average human pilot aiming the plane at the ground and thinking its ok....." Unfortunately, the investigation into the crash of Air France Flight 447 showed that unskilled pilots were too reliant on computer aids and were happy to fly their jet into the ground (or the sea in their case), despite other "manual" aids (like the stall warning horn) telling them different. The key to Flight 447's demise was ice-blocked speed sensors, which therefore gave incorrect readings to the computer. This caused the autopilot to disengage as the computer decided it couldn't trust itself, the more-experienced captain pilot was on a rest break, whereupon the inexperienced copilots stalled the jet into the sea. In the Quantas case it seems the passengers were lucky their captain was in charge at the time of the crissis.

          7 1
          1. Homard
            Reply Icon
            FAIL

            Basic Airmanship

            Matt, basic airmanship is to ensure the plane will fly. Pointing the nose at the sky, even with full power is not the way to do this. By flying at sensible attitude with sensible power should ensure the plane flies. Watch the altitude and you can get an idea if you've got it about right with the rate of sink or rise. Now the 'pilot' never knew that the idiot 'flying' the plane had the stick back due to averaging feedback. Good design ? **NOT** ! The deep stall that resulted is easy to understand. The pilots never understood this until too late. I am truly puzzled as to why. Training issue ?

            Now back to the original article, 2 out of 3 voting of inputs should have voted the faulty unit out. Either it was intermittent, or more worryingly to me, another device agreed within tolerances. Starting to prefer Boeing as they let the pilots have control when needed, and certainly the(nose high) stick position would be more obvious.

            There is far more need for focus on training over the automation in each plane. Airbus have had their share of issues. The air france crash at the paris airshow in the late 80's was due to both pilot error (rushed unfamiliar manouvre) and the avionics (switching to landing mode without sufficient pilot warning).

            Enough to say FAIL. Hope this encourages the whole industry to look at the cockpit automation issue. It is supposed to increase safety. I ask is it ?

            0 0
        3. Greg J Preece
          Reply Icon

          "Doing an emergency stop on a busy motorway wont be fun."

          This is only because arseholes drive too close to the car in front. If all cars were computer controlled, they wouldn't do that, and a car stopping in an emergency would alert the cars around it. Job's a good 'un.

          I only say this because planes have exactly those kinds of system - automatic distance and collision warnings and computer-negotiated advice to the pilots on whether to ascend/descend/change underwear.

          99% of the time the computer can fly the plane just dandy, but you should always have a meatsack ready in case something goes wrong. Duh.

          8 2
          1. JohnMurray
            Reply Icon

            Well...

            The big selling-point for computer controlled cars/vehicles is that they could be driven at minimal distance from the other space-attending vehicles: Front/Back/sides

            0 0
        4. Anonymous Coward
          Reply Icon
          Anonymous Coward

          Pilot - or not

          It's a well-known fact amongst pilots that there are two seats in an airliner cockpit for a specific reason; one for the pilot, and the other for his dog. The pilot is there to feed the dog, and the dog is there to stop the pilot getting anywhere close to the controls!

          Seriously, look it up.

          AC, 'cos I may lose my right to free flights!

          6 0
        5. nichomach
          Reply Icon
          Stop

          "While, on average, the computer control is safer, you won't find the average human pilot aiming the plane at the ground and thinking its ok."

          Except they do:

          http://en.wikipedia.org/wiki/Spatial_disorientation

          http://en.wikipedia.org/wiki/Sensory_illusions_in_aviation

          http://www.avmed.in/2011/04/spatial-disorientation-an-introduction/

          The bottom line is that there is no single right answer; there are times when the computer control will malfunction, but so far those have been rather a lot less than those incidents where the human pilot has "malfunctioned".

          7 0
        6. Anonymous Coward
          Reply Icon
          Anonymous Coward

          While I do agree in principle with the Honorouble Anonymous Coward that:

          "While, on average, the computer control is safer, you won't find the average human pilot aiming the plane at the ground and thinking its ok."

          I also wish to point out that, statistically, you may find more instances of people in control of the aircraft who, for various reasons, or no reasons, have decided to point the nose of the aircraft, if not to the ground, then towards other impactable objects.

          1 0
          1. JohnMurray
            Reply Icon

            Icing of the Airspeed Indicator Pitot tube has been responsible for very many manually controlled aircraft incidents over the past century.............

            0 0
      2. Number6
        Reply Icon

        Inexperienced Humans

        The problem is that the system is back-to-front. Far better to have the humans flying and the computers monitoring for errors than the other way around. Human nature being what it is, the pilots get to trust the automatics and lose valuable time in the rare event that something bad happens. With a lot of airline SOPs dictating that automatics should be used as much as possible, they also don't get practice at proper flying and, as was demonstrated by the Air France transcripts covered by El Reg recently, you end up with a pilot who actually can't fly the aircraft without help from the computers.

        2 1
    2. laird cummings
      Reply Icon

      3 incidents in 128 million hours of operation..?

      Sounds pretty decent to me - Humans at the flight controls haven't done as well.

      17 0
      1. Version 1.0 Silver badge
        Reply Icon
        Happy

        Software "bug" of sorts

        So basically - if I'm reading the report correctly - 1 of 3 inputs goes haywire intermittently ... but the software decision tree was expecting a hard fault, not a soft fault and when the device seemed to agree with the other two it but it back on-line only to have it go tits up again?

        Averaging different inputs .... now where have we seen that recently?

        Probably a human code bug - an unforeseen condition that the coders did not predict. My guess is that they will be burning some midnight oil with code reviews for a while now. Interestingly enough (after the industry accidentally killed a few people) when you write medical software, the first question asked is, "How can this kill someone?" ... reviews of flight code need to be, "How can this crash the plane?" ... not "How can we get the answer right?" - there's a big difference.

        5 2
        1. Joe Cooper
          Reply Icon
          Joke

          Averaging

          "Averaging different inputs .... now where have we seen that recently?"

          Do you mean <a href='http://dilbert.com/strips/comic/2008-05-07/'>this</a>?

          5 0
          1. Mephistro
            Reply Icon
            Joke

            @ Joe Cooper

            "<a href='http://dilbert.com/strips/comic/2008-05-07/'>this</a>"

            We're being invaded by Slashdot! Run to the hills!!!

            2 0
        2. Yag
          Reply Icon
          Headmaster

          "reviews of flight code need to be, "How can this crash the plane?"

          well... it IS the case, in theory.

          The quite old DO-178b standard define 5 levels of dev process, from the "A" level (a failure may lead to a plane crash - Most of embedded software is rated at this level) to the "D" level (no real impact - Usually used for the maintenance software which is allowed to be used only in the hangar - And yes, the bootstrap preventing the use of such software in flight is A-level).

          The "E" level is a bit special, as it refer to any non-DO software (quite rare actually. Even In Flight Entertainment softwares are classified as level C or D, as a failure of those will lead to additionnal work for the cabin crew : passengers are usually quite nervous when faced with a BSOD in a plane, i wonder why...)

          Practically, due to budget constraint, the software activities are subcontracted by the "stamper" to the "best" (AKA lowest) bidder. The one with the cheap right-out-of-the-school graduate.

          Me? I'm on this turf since 1999...

          4 0
          1. Version 1.0 Silver badge
            Reply Icon
            Happy

            "in theory"

            Good point - but as they say "In theory, there is no difference between theory and practice. But, in practice, there is."

            In the end it's simply unrealistic to expect that any code will be perfect - which is why the pilots are there to give it the three fingered salute (just joking, for all you PPRuNe devotees).

            Overall, flying is a hell of a lot safer these days than when I was a kid.

            2 0
  7. Notas Badoff
    WTF?

    Please keep your seatbelt on....

    "Around 60 people were flying without their seatbelts fastened, despite being warned not to do so, and many were slightly or seriously injured after being thrown into the ceiling or side panels of the aircraft."

    So of the 110 or so people injured, half of those were because some "free spirit" suddenly decided to occupy the same body space? Because they didn't want any restrictions on their freedom to move?

    5 4
    1. Gordon 10
      Reply Icon

      Actually given 60 people were flying about its entirely possible that the other 50 were injured by them.

      13 0
      1. Intractable Potsherd
        Reply Icon
        Thumb Up

        Correct, Gordon ...

        ... but don't forget to add high-speed laptops, phones (in Flight Mode, of course), books, wine bottles, poorly stowed baggage ...

        The list of serious injuries to those not properly secured is actually quite small.

        (I don't understand the people that undo their belts as soon as the light goes off - it's an aluminium tube blasting through the sky at hundreds of miles an hour. What could possibly go wrong?)

        3 0
        1. Alex King
          Reply Icon
          Thumb Down

          Or...

          It's an aluminium tube blasting through the sky at hundreds of miles an hour. What good would a loosely-adjusted lap belt possibly do.

          I'd tend to suggest that thouse seatbelts are more there to stop panicky people jumping up and running around or provide some misguided reassurance, than any strong intrinsic safety properties. Three, four or five point harnesses for that job, methinks.

          1 2
    2. Anonymous Coward
      Reply Icon
      Anonymous Coward

      Not all of the others would be injured by flying bodies; some number were probably in the bathroom, waiting for the bathroom, going to/from the bathroom; some were at a galley getting another drink or flirting with a stew, and a mother may have been walking her child down the aisle.

      1 0
  8. JeffyPooh
    Pint

    Told ya so...

    Airbus aircraft are too often brought down by software bugs (a.k.a. "pilot training" [sic]), with the aircraft structure being in perfect mechnical condition in the millisecond before impact. If they could "...Just....Pull-up...", then the aircraft would need nothing more than a software fix and the seats cleaned.

    Boeing aircraft are often already heavily damaged on the way down. Even if they landed in a mile-high pile of peacock feathers, they'd still require major structural repairs.

    Those that deny this observation about the too common distinction in the two major brands are doing a disservice to the safety of aircraft in general.

    Yes, there are always exceptions. This is a 60/40 (or perhaps even 70/30) percentage thing.

    It *is* way beyond statistically significant.

    1 33
    1. Uncle Slacky Silver badge
      Reply Icon
      Stop

      |citation needed]

      20 0
    2. Gordon 10
      Reply Icon

      Really? Maybe you would care to post some links to back that up?

      3 0
    3. Anonymous Coward
      Reply Icon
      Anonymous Coward

      Do you work for Boeing, or are you just another anti-European Yank twit? If you actually knew anything about the subject, you'd know that modern Boeing aircraft are as full of software & fancy electronics as modern Airbus craft. To describe you as a muppet is an insult to muppets.

      27 0
      1. Gary Bickford
        Reply Icon

        Boeing and Airbus have different philosophies re human control

        I don't recall the details and I'm too lazy to look it up, but I have read articles about the different philosophies embedded in the two companies' design rules. If I recall correctly, Boeing essentially trusts the pilots more than Airbus - the pilot is the final authority. He/she has the ability to override (some/all?) controls in ways that _might_ damage the aircraft, but also as a result has more ability to force the airplane to do what's necessary when the automated systems are screwing up. It supposedly goes back to Boeing's military heritage, where getting your own ass home might be more important than preventing the wings from being bent. (Many WWII fighter planes had a 'war emergency' power setting, which provided another boost of horsepower from the engines, but required an engine rebuild as soon as you got back to base.)

        In summary, it's about who/what is the final authority - the pilot or the computer. I can't say definitively which is the best approach, but I'm inclined to go with the pilot most of the time - but this does demand that the pilot know enough to be trusted with that authority.

        But, as I noted, I could have misremembered the whole thing.

        1 0
        1. PeterM42
          Reply Icon
          FAIL

          "......the pilot is the final authority...."

          What? like in the FADEC system installed in the Chinook which crashed on the Mull of Kintyre?

          But the MoD said was "pilot error" (now disproved).

          I DON'T THINK SO.

          May the Lord preserve us from hairy-@rsed programmers, MoD "experts", poor maintenance and inadequate safety systems.

          0 0
      2. Denarius
        Reply Icon
        Meh

        true, but irreelvant

        Boeing: Pilots can and do (sometimes disasterously) over-ride the flight computers.

        Airbus: Meatsacks have no final say.

        not subtle difference, which AFAIK, made no difference in this situation.

        Concur with two failures in one unit ? junk it comment.

        4 0

Page:

This topic is closed for new posts.

Other stories you might like