back to article Boeing 787 software bug can shut down planes' generators IN FLIGHT

The US Federal Aviation Administration (FAA) has issued a new airworthiness directive (PDF) for Boeing's 787 because a software bug shuts down the plane's electricity generators every 248 days. “We have been advised by Boeing of an issue identified during laboratory testing,” the directive says. That issue sees “The software …

Page:

  1. Anonymous Coward
    Anonymous Coward

    Is this the (in)famous

    Screamliner with the "exploding flaming battery issue" that required ripping out the defective unit with crowbars to prevent the whole plane being written off?

    (makes note never to fly on it)

    Seriously, a quadruple failure of avionics would make even "Macgyver" think twice about boarding that flying death trap!

    1. anothercynic Silver badge

      Re: Is this the (in)famous

      Errr no.

      There *never* was a case of, in your words, "ripping out the defective unit with crowbars".

      *eyeroll*

    2. Anonymous Coward
      Anonymous Coward

      Re: Is this the (in)famous

      Maybe related to the infamous Crucial SSD which shutdown after 5,184 hours? (but that's 216 days)

      http://forum.crucial.com/t5/Crucial-SSDs/M4-firmware-0309-is-now-available/td-p/80286

      At least there was a firmware patch for that.

      Presuming they can't patch the bug in the 787 because that would invalidate the certification of the software...?

      1. ST Dog

        Re: Is this the (in)famous

        The article plainly state they are working on a fix:

        Boeing is working on a fix and the FAA says “Once this software is developed, approved, and available, we might consider additional rule making.”

        Yes, it takes a bit longer due to the airworthiness approval, but it won't take long.

        The current "fix" is to cycle them off every 120hrs;.

        1. pompurin

          Re: Is this the (in)famous

          Because I'm such a geek and had to see if this was as easy as I thought:

          Signed 32-bit upper limit: 2^31 = 2,147,483,648

          Seconds in a day * 100 = 8,640,000

          248 days = 2,142,720,000

          So looks to me like their counter is 0.01s :)

          1. Anonymous Coward
            Anonymous Coward

            Re: Is this the (in)famous

            Saw the same kind of bug on <Recent superjumbo plane> glass cockpit : a warning that was staying on the screen instead of disappearing after 5s if it occured roughly 1h11 after the last restart of the display unit.

            I let you do the math ;)

            1. Anonymous Coward
              Anonymous Coward

              Re: Is this the (in)famous

              Downvoted by a lazy commentard I guess...

              Quite easy, it was a 32-bits timer with a microsecond resolution.

              Worse is that the underlying OS actually use 64-bits timers, but the applicative software layer assumed only the least significant word was useful...

            2. anonymous boring coward Silver badge

              Re: Is this the (in)famous

              Have an upvote to compensate from some moron's downvote.

  2. Kanhef

    So...

    How often do planes operate, without shutting down, for more than eight months at a time?

    1. Simon Sharwood, Reg APAC Editor (Written by Reg staff)

      Re: So...

      At a guess, often enough for Boeing to tell the FAA and the FAA to issue a new directive.

      1. Anonymous Coward
        Anonymous Coward

        Re: So...

        Power could be left on 24/7, but even in that unlikely event the aircraft would still be powered down eventually for scheduled maintenance. So to encounter this in the real world you need an operator who basically doesn't operate his aircraft, such that it doesn't need maintenance for 8 months, yet still leaves it powered up continuously. The fact that 787s have been in service for three and a half years now, and more than 250 of them are flying without this fault being encountered, shows how improbable this is. Of course it needs fixing - continually eliminating risk is how aviation has become as safe as it is - but in practice this one is no big deal.

        1. Cliff

          Re: So...

          I agree it's less of an issue than it sounds, but 250 craft for 3.5 years for a bug that shows up every 5/7 the of a year. It's around a potential 1000 cycles in total at most, dramatically less if they've been powered down out of service for, say, battery replacement work.

        2. Graham Triggs

          Re: So...

          It's the generator control unit, not a control unit powered by the generator.

          Which suggests it may be receiving power (from a battery?) without the generators switched on. So the possibility of encountering it may be higher than you are assuming.

          But practically, there will be safety checks and maintenance, which likely have resulted in GCUs being reset inside 248 days, so no real problem. Especially as now people know to consciously do it.

          You never know though, we may have come alarmingly close to a catastrophe.

        3. Anonymous Coward
          Anonymous Coward

          Re: "in practice this one is no big deal."

          "in practice this one is no big deal."

          The big deal is that this is a problem that could and should have been identified and eliminated before entry into service, but it wasn't.

          Time-dependent arithmetic overflows don't come out of nowhere and aren't new technology (even Windows 95 had them). Checking the design and implementation for things like arithmetic overflows isn't exactly rocket science either.

          Not finding such a readily identifiable problem until over three years after the relevant kit has been in service does not say what you think it does - it says that proper risk assessment, design and test practices have not been followed. Can't imagine how that happened...

          1. Destroy All Monsters Silver badge
            Facepalm

            Re: "in practice this one is no big deal."

            The big deal is that this is a problem that could and should have been identified and eliminated before entry into service, but it wasn't.

            This is probably coming from some dude who codes websites in PHP and get his requirements from a 5-second chat in doorframes...

            1. werdsmith Silver badge

              Re: "in practice this one is no big deal."

              This is probably coming from some dude who codes websites in PHP and get his requirements from a 5-second chat in doorframes...

              Hmmm, superciliousness. Not pretty.

              Regardless of who it comes from, it's still a valid point.

              1. Destroy All Monsters Silver badge

                Re: "in practice this one is no big deal."

                it's still a valid point

                It's also a valid point to ask why the real world doesn't work as I want it to. Only idiots and politicians make it a talking point though.

            2. Anonymous Coward
              Anonymous Coward

              Re: "dude who codes websites in PHP"

              "this is a problem that could and should have been identified and eliminated before entry into service, but it wasn't." (me)

              "This is probably coming from some dude who codes websites in PHP and get his requirements from a 5-second chat in doorframes..." (you)

              Guess again.

              Remember DEFSTD 00/55? I used to.

              Know much about 178C (as well as B)? I used to.

              Got any safety critical code flying? I still do; stuff I wrote in the 1980s that is still out there.

              I barely know what PHP is except it seems to be popular as a security vulnerability exploitation vector.

              Even so, if some presentation layer person made the comment I made about it being a defect that could and should have been detected and fixed before entry into service, does the comment's oriigin make the comment wrong? It's not the messenger that matters, it's the message.

              1. Yag

                Re: "dude who codes websites in PHP"

                Know much about 178C (as well as B)? I used to.

                You mean the DO-178C? I understand that you are a bit angry, but "used to" know a 4-years old standard that is not yet fully deployed is a bit exagerated...

            3. anonymous boring coward Silver badge

              Re: "in practice this one is no big deal."

              Have to disagree.

              The important point here is that some software is deemed worthy of massive certification efforts, and some is obviously not considered as important. In reality almost all software may cause a serious accident.

              Compare the military Airbus that crashed recently, that had the wrong engine parameters "flashed" to the engine management software. A case of being lax in one area for no particular reason other than that no-one has bothered to identify it as important.

              This is a recurring theme in air disasters.

          2. Anonymous Coward
            Anonymous Coward

            Re: "in practice this one is no big deal."

            "Time-dependent arithmetic overflows don't come out of nowhere and aren't new technology (even Windows 95 had them). Checking the design and implementation for things like arithmetic overflows isn't exactly rocket science either."

            But it is aerospace system engineering

            1. An ominous cow heard

              Re: not rocket science

              ""Checking the design and implementation for things like arithmetic overflows isn't exactly rocket science either." (me)

              But it is aerospace system engineering" (you)

              It sure is, and one might hope that its importance was widely recognised. Does experience generally match the theory?

              In the "systems engineering" department I'm most familiar with, the importance was recognised in name but not in reality. There was one actual systems engineering graduate and a variety of "systems engineers" from other backgrounds. Good people to have on the team, but not necessarily real "systems engineers".

              If the department was desperate enough for manpower, almost anybody (of whatever background) from almost anywhere in the company could become a "systems engineer" overnight.

              Is that really an approach that the industry should be adopting?

            2. a_yank_lurker

              Re: "in practice this one is no big deal."

              AE = Almost Engineering

          3. Stumpy

            Re: "in practice this one is no big deal."

            "it says that proper risk assessment, design and test practices have not been followed. Can't imagine how that happened..."

            ... sounds like the aircraft was designed and built using Agile...

          4. JLV

            Re: "in practice this one is no big deal."

            Correct me if I am wrong in this but as far as I understand, airplanes are very safe because all the flight control software is written independently from specs in triplicate. Then all 3 control programs run concurrently with a majority poll deciding what happens if one program is in disagreement with the rest. So, in theory and pretty much in practice, you can ride out any one bug.

            But... this was not on the flight control software, so there would have been no triple redundancy around. Granted, the likelihood is pretty low of this flaw coming into play, but you still have a critical component that is not triple redundant so finding such a flaw is scarier than flight control software proper, isn't it?

            The fact that it wasn't likely to be a problem in this particular instance is not a reassurance to the QA and redundancy factors for secondary but critical programs.

            On the other hand, the fact that they did find the bug during lab testing is a good sign.

            1. Anonymous Coward
              Anonymous Coward

              Re: dissimilar redundancy

              "all the flight control software is written independently from specs in triplicate. "

              Relatively frequently mentioned, extrememely rarely provided with definitive references of where it actually happens in production systems.

              (And afaik it doesn't apply to the engine control systems anyway. Still, what could possibly go

            2. Alan Brown Silver badge

              Re: "in practice this one is no big deal."

              "all the flight control software is written independently from specs in triplicate."

              Used to be. Nowadays they use three copies of the same software, rather than multiple implementations.

      2. Trigonoceps occipitalis

        Re: So...

        Won't Boeing be running a test rig?

      3. JustNiz

        Re: So...

        Your paranoia is excessive.

        Boeing and eveyr other aircraft manufacturer automatically notify the FAA of every and any potential fault they detect, no matter how unlikely in real life. Even if all 4 GPUs failed simultaneously, you do realise the plane also has batteries right?

        1. Alan Brown Silver badge

          Re: So...

          "you do realise the plane also has batteries right?"

          You do realise the batteries have enough capacity to last about 10 seconds if all 4 GPUs go down, don't you?

          They're designed to stabilise switching breaks, not carry full load.

      4. This post has been deleted by its author

      5. RobHib

        @Simon Sharwood - Re: So... Some thoughts.

        Reckon that's so but also there are broader issues here; essentially they're issues that emerge from complexity.

        To the point: the complexity of modern airliners like the Boeing 787 and Airbus A380 are such that it's just not possible in any practicable sense to cover every functional mode of operation, design limitation and failure mode let alone properly evaluate all their relevant parameters [design limitations/omissions, failure severity, event probability etc.] through rigorous state analysis and similar techniques.

        Anyone familiar with state analysis will know that it's nigh on impossible to cover every aspect (design limitations, failure modes etc.) of a system as 'simple' as a domestic VCR let alone one as complex as a modern jet airliner–even a VCR's complexity is such that the computational problems are enormous. Just defining the parameters for such tests alone is problematic.

        I'm not saying that these modern airliners aren't reliable, clearly they are but putting an exact measure on 'reliability' just isn't possible with today's state-of–the-art. The fact is we've still to rely on the best expertise that's available and this ultimately boils down to the combined expertise and experience of the engineers, designers and manufacturer's wherewithal etc.–not to mention bean-counters and budgets.

        Let me give you an example: the well-publicized Qantas QF32 A380 [2010-11-04] engine failure. The Rolls-Royce T/900s each generates about 20 terabytes of monitoring data per hour yet this was 'insufficient' to give any forewarning of the failure. Moreover, after the failure–despite the many hundreds of thousands of sensors on the A380–the pilots still had insufficient (or perhaps inappropriate) monitoring for them to determine what failed sufficient to the extent necessary to safely navigate and land the plane.

        Sufficient data was only gathered after a passenger reported damage to the wing and a pilot visually inspected the damage from the passenger's seat. With all of the A380's sophisticated monitoring, human intervention (a human sensor) was still necessary.

        The issues that arise are complex and many but the essential ones are reasonably clear: we now know the exploding engine cut sensor and control lines thus cutting off essential data to the pilots. The question is why this eventuality wasn't allowed for in the original design (given that engines have previously failed/exploded and cut control lines long before this incident). Also, why didn't a state analysis pick up this issue beforehand in the early design phase?

        Moreover, given the long history of control cable/hydraulics failures (by being severed) and leading to crashes [e.g.: UA FLT 232, (1989); AA FLT 96, (1972)], one has to speculate why in such a modern aircraft the few truly critical circuits weren't also backed up by wireless links (powered at sensor source). Same goes for why there were no iPhone-sized camera 'sensors' in critical places–for pilots to view the engines etc. (as we all know from our phones, this is pretty trivial these days).

        Similarly, Airbus designers appear not to have taken into account the overwhelming levels of error messages generated in the cockpit by the computer-based information system. It was essentially useless, as the huge amount of data presented forced the crew to process the data manually and in a time of great stress and with very limited time. The pilots reported that at no time during their training had they ever had to experience this level of data overload–had it not been for the extremely professional crew the craft could have been lost. The problem with the status/fault monitoring is nothing less than a very significant ergonomic design failure. (It's a damning indictment, as there's seemingly no reason why this problem should not have been foreseen.)

        Effectively, the design parameters, in sum, were passed to be an 'acceptable' risk but in practice they were not.

        There's no doubt the QF32 incident raises serious concerns, and both the regulators and Airbus need to be put under the spotlight for a series of problems and events that compounded to considerably more than could ever just be attributed to force majeure alone. That said, what is even more key is that this incident clearly shows that our current understanding of complex systems is very limited. State analysis etc. as applied to large complex designs such as modern aircraft has a long way to go before it can be considered mature engineering. Designers need to heed this fact.

        In my opinion, the chain of events that led to the QF32 incident is a brilliant encapsulated example of the same kinds of problems we all too often see in large computer systems, Windows, the internet etc. Perhaps we computer types should spend more time examining them.

        1. Anonymous Coward
          Anonymous Coward

          Re: RobHib's thoughts.

          Nice writeup. Can I add a few thoughts?

          *) Complexity vs confidence

          Complexity is a challenge, but you can go wrong without that much complexity if you're overconfident. If you're overconfident, all kinds of things can go wrong. (Other factors besides overconfidence are also possible).

          The words of Charles Haddon Cave to the conference on the 25th anniversary of the Piper Alpha disaster are interesting. Haddon Cave led the Nimrod inquiry, and others simialr. He's not an engineer, but he sure has a clue on how things go wrong:

          http://www.oilandgasuk.co.uk/templates/asset-relay.cfm?frmAssetFileID=3251 (20page transcript)

          https://www.youtube.com/watch?v=y99_lhFFCsk (50minute speech, few visuals)

          *) Statistics of small numbers

          Lots of aspects of safety-critical system design involve failure rates along the lines of "1 in 10**6 hours" or similar. You can't demonstrate compliance to this by testing, not in any reasonable timescale or over any reasonable fleet size. What does that leave? Modelling? OK, but...

          You mention QF32 (in which it was a miracle there were no casualties). Around that time, RR actually had three "uncontained engine failures" during a year or so (QF32, one on a test rig in Derby, and one I forget). (NB this is not a dig at RR, GE doubtless have their challenges too).

          A UEF is an incident in which high energy debris escapes from the engine - typically, a piece of something that's been rotating at very high speed. It's pretty unlikely that this will happen - in fact it's NOT supposed to be able to happen. If it does happen, whatever's in the firing line won't survive. But the design is supposed to prevent it happening at all, so is there any reason to cater for it happening?

          Was the three indicative of a trend, or just an unfortunate coincidence? How would anyone know? As far as I'm aware there haven't been any other UEFs on that engine family since then, does that mean everything's now OK? What might happen in the next 12 months?

          *) Drowning in data, searching for information

          The "too many alarm messages" issue was known about elsewhere, literally decades ago. Any half competent SCADA vendor or user would understand the problem, and how it might be mitigated. But it seems the aircraft engine vendors think they're the experts on all they need, and thus they don't always look to see what they can learn from other parts of industry.

          *) Terabytes per hour

          I don't know where this figure comes from but for a flight engine its many orders of magnitude too high, and even for a fully instrumented engine test rig it's way too high. Not to worry.

          1. RobHib

            @A.C. – Re: RobHib's thoughts.

            A.C., thanks. Short of time to elaborate on your comments here except to say I agree with them. Will reply in more detail later. Also, Charles Haddon Cave video is fascinating, recommended viewing, and has echoes of similar things/incidents that I've experienced (but luckily with fewer repercussions).

            In the meantime, with reference to TB/h 'I don't know where this figure comes from...', here's one immediate reference, there's others too: http://www.trilliumsoftware.com/success/_pdf/DataIQ_Fall12-Nigel-Article.pdf.

            1. Anonymous Coward
              Anonymous Coward

              Re: @A.C. – RobHib's thoughts.

              Glad you enjoyed the CHC stuff. I await your further thoughts with interest.

              Re: http://www.trilliumsoftware.com/success/_pdf/DataIQ_Fall12-Nigel-Article.pdf

              "the A380 Airbus is viewed as the world’s smartest plane as it is said to run on over one billion lines of code. It contains a large number of sensors and microprocessors, each monitoring and reporting on the health of its systems. For instance, each of its four engines generates 20 terabytes of data on its performance in flight every hour."

              It's far from a definitive source. Others welcome. I'm sensing a severe case of marketing/Chinese whispers here.

              Based on what I know about engines, sensors, controls, and connectivity, it is almost infinitely improbable that 20TB an hour is recorded in this picture. It's barely plausible that 20TB an hour is *processed* (without being recorded). Even allowing for massive compression (which would be theoretically easy, but practically might be a challenge, due to the adverse environment alongside an aircraft engine, though a DSP might do the job).

              NB what follows is not intended as personal criticism. You have been told something, and taken it at face value (as have others). But it's garbage (at worst) or widely misunderstood (being generous). That's OK, there's a lot of that about. I happen to see the implausibility in this case because it's an area I used to know a bit about.

              We can take a look at this in a couple of ways: e.g. how much data can we get out of the engine control+monitoring system, as limited by its connectivity. And how much data is plausibly going into that system, based on sensor count and sample rate, stuff like that. Back of the envelope, scientific wild assed guess, not intended to be strictly accurate.

              *) Data out of the engine control+monitoring

              Assume there's no recording system which can survive engine mounting so we need to get the data out over a network. It'll be ARINC664 or AFDX or whatever. Think full duplex ethernet, with some design guidelines to make it better suited to time-critical and safety-critical applications.

              Assume 100MBit/s (couldn't find a definitive statement). Make that 10Mbyte/s. Use ALL of it for this recording stuff. So, 10Mbyte/s, in the 3600 seconds in an hour.

              Thus: 3.6 GB an hour that we can get from engine to elsewhere.

              Use a handful of them if you wish, use Gbit if you wish, you can't plausibly make that to Terabytes an hour, whatever the "big data" people say. Apart from anything else, a computer on the engine connected to those sensors has to *send* the data. That capabiliy just isn't there right now. It might be there in three or five years time. Maybe.

              *) Data into the engine

              The main output of the engine control is a fuel flow control value. It is based largely on the pilot's lever angle. A raft of other important factors which figure into the calculations or must be measured for other reasons include various rotational speeds, various pressures and temperatures, and so on. Various sensors are duplicated or triplicated. Various outputs are monitored for safety/integrity reasons. There's lots more stuff too, to do with things like thrust reverser interlocks and other important stuff. This'll do for now.

              Let's for the sake of argument assume 500 sensors on the engine. That may be a bit of an overestimate; the nice people in RR, GE, etc will confirm or otherwise, but it doesn't actually matter much here. Also, it doesn't vary hugely from engine to engine. Let's assume that on average we're sampling every 20ms (some will be more frequent, others less). Let's assume 4 bytes per sample (again, generous). 500 sensors at 4 bytes = 2kbytes/sample. At 50 samples/second that is 100kbytes/second. 3600 seconds per hour:

              Thus: 360 MB per hour of raw unprocessed sensor data.

              Maybe there's advanced engine health monitoring to consider as well. One day. Today, that's for test purposes only (you can do lots of engine health monitoring with just the existing signals in the control unit).

              So two entirely independent approaches both suggest there's **very very roughly** a Gbyte an hour of raw data. Certainly nowhere near terabytes an hour per engine.

              Corrections and clarifications welcome.

              Some wag on slashdot already questioned the Terabytes/hour data rate and suggested that it'd easily get to terabytes an hour if you put it into XML (text dataname, text timestamp, text datavalue, text units, etc).

              I still struggle to see how it gets to terabytes an hour.

              1. Anonymous Coward
                Anonymous Coward

                Re: @A.C. – RobHib's thoughts.

                NB There is at least one arithmetic mistake in my earlier post. The conclusions still stand.

                [Hint: 10MByte/s: what's that in an hour?]

        2. bep

          Re: @Simon Sharwood - So... Some thoughts.

          I wondered for some time why passenger aircraft didn't have cameras monitoring the trailing edge of the wing. Then I thought I read that such cameras had been implemented, but is seems not. This seems like a basic safety feature that should be mandatory. The other question is, is it time for the reintroduction of a flight engineer to monitor all this feedback information that is overwhelming the pilots?

          1. Anonymous Coward
            Anonymous Coward

            Re: flight engineer

            "is it time for the reintroduction of a flight engineer to monitor all this feedback information that is overwhelming the pilots?"

            It's a very fair question,

            What seems to have happened over the years is that the pilot's routine job has been 'de-skilled' (?not quite the right word, maybe 'de-stressed'?) by cockpit automation. But in non-routine circumstances where the automation isn't useful, the automation-dependent crew may struggle, potentially leading to a serious incident. There are plenty of recorded and analysed instances where this has happened. A distressing number of them involve casualties, often fatalities (e.g. failure to reach the runway, in good visual flying conditions, when part of the airport's landing guidance system is undergoing planned and notified maintenance: Asiana Flight 214, 2013, San Francisco).

            [Fwiw there is a somewhat similar syndrome in high speed railways]

            The engine damage and resulting connectivity loss on QF32 didn't even involve casualties afaik. One of a number of reasons for that was that the dice on that day had rolled in such a way that it was a high level training+assessment flight and there were several extra very experienced staff in the cockpit who were able to go through checklists, attempt to read between the lines of status messages, and so on. Without that, the result might have been different.

            Interesting question. I have no answer for it. Maybe the NTSB, FAA, etc need to give it some thought.

        3. Alan Brown Silver badge

          Re: @Simon Sharwood - So... Some thoughts.

          "given that engines have previously failed/exploded and cut control lines long before this incident"

          Hydraulic fuses now standard (after the Kansas City DC10 crash)

          Multiple wing routes for the redundant systems (after various incidents of losing all systems with one cut)

          As for the engine: Uncontained compressor failures are vanishingly rare vs fan disc failures (which are designed and tested for). In any case, I doubt that there's an engine casing material in existence which could be made strong enough to hold it all together without imposing unacceptable weight penalties.

          You can make civil jetliners strong enough to withstand any scenario, but the problem is they'd probably be so heavy they'd never make it off the runway. Every risk and mitigation has to be balanced against probabillities.

          Thankfully fixing software doesn't add weight however the reality is that the level of checking of such things is far less stringent than that applied to the mechanical side of the operation.

    2. Mark 85

      Re: So...

      At most airports, when they land and shut down the engines, ground power is connected. If this is like many aircraft, all electronics including the GCU's would have power. I guessing the solution is to disconnect the batteries and ground power every 247 days. Truly a cold reboot.

      Edit: I'm not sure if the 787 has a breaker for each GCU to completely remove power from the unit. As I recall, some A/C do and some don't.

      1. Roland6 Silver badge

        Re: So...

        I guessing the solution is to disconnect the batteries and ground power every 247 days.

        The directive requires operators to perform and electrical power deactivation at intervals not to exceed 120 days. So it would seem that it is typical that planes are not routinely electrically power deactivated.

        It would be interesting to know how Boeing discovered this fault, I suspect it may have arisen from a review of reliability/fault data and someone spotting a common theme...

        1. ST Dog

          Re: So...

          Said they found it in the lab.

          I'm guessing they the integration lab where they would have a mockup with actual generators and other systems up and running 24-7 for months on end doing long running tests.

          Despite other posts to the contrary, I don't not expect this to be caught earlier.

          They just don't do a lot of test spanning 100s of days.

          The software designers expected the unit to be shut down more often.

          Bad specs/requirements that didn't convey that the unit needed to stay up that long (or even longer)

        2. Alan Brown Silver badge

          Re: So...

          "It would be interesting to know how Boeing discovered this fault"

          Most likely the static test article (which wouldn't normally be powered down) exhibited it.

          I wouldn't be at all surprised to find that Boeing have more of these hiding away - and not just on the screamliner.

      2. Nick L

        GCU...

        GCU puts me in mind of Iain M Banks' incredible craft the size of small cities... Bit of a way to go to get there! (Yes, I realise GCU is generator control unit )

        1. Deryk Barker

          Re: GCU...

          James Blish?

          Banks was just 8 years old when the final volume of Cities in Flight was published in 1962.

      3. Charles Manning

        Have the breakers been disabled?

        "I'm not sure if the 787 has a breaker for each GCU to completely remove power from the unit. As I recall, some A/C do and some don't."

        Since the German pilot crashed the recently, there has been a scramble to disable stuff so that pilots can't turn things off when they want. I wonder if preventing GCUs fits into that?

    3. Test Man

      Re: So...

      "How often do planes operate, without shutting down, for more than eight months at a time?"

      Think about it - when do you ever power down your car? Never. Switching the ignition to "0" isn't turning it off in the same way pressing the power button on your TV isn't actually turning it off either. The same with planes.

      1. Byham

        Re: So...Garbage from Non-Aviators

        Aircraft when they land for a night stop will always shut off the generators and APU and go onto ground power. Aircraft also have a series of standard maintenance checks that are mandatory the A checks after ~ 200-300 flight hours and a B check every 6 months with the aircraft in a hangar for 2 - 3 days. The generators will be off and the maintenance includes disconnecting and checking batteries.

        This is not a flight safety problem

        However, it is a program standards and testing problem that should not be there and obviously a counter overflow of some sort that Boeing felt it should report. It shows up a poor program test if counters can overflow and haven't got a standard handler to reset them. Both the programmer team and the test team should be in front of the leather top desk :-)

        1. Yet Another Anonymous coward Silver badge

          Re: So...Garbage from Non-Aviators

          They shut off the generators but does that necessarily shut off the power to the computer controlling the generator?

          Are they sure that a particular check disconnects all the many redundant power supplies to the GCU? Is this documented in the check?

        2. Fatman
          WTF?

          Re: So...Garbage from Non-Aviators

          Both the programmer team and the test team should be in front of the leather top desk :-) taken out behind the woodshed, and...(you fill in the blank)

          FTFY

Page:

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Other stories you might like