History's Worst Software Bugs

[sechs]

No mention of Airbus's fly-by-wire mistakes....
http://www.wired.com/news/technology/bugs/0,2924,69355,00.html

 

[Tannin]

You are dreaming, Sechs. Fly by wire software in commercial airliners is astonishingly good, and has been since its inception. Fly by wire airliners have crashed (at least three brands) but in almost all cases - and certainly in the famous high death toll ones - human error on the part of crew was the culprit.

 

[Tannin]

PS: you will still see those gross slanders repeated from time to time, but only in the US, where some ill-educated people still blindly try to hang on to rumours put about because Airbus (a) is #1 in the aircraft industry and (b) isn't from the United States.

 

[sechs]

You can't fight the truth, buddy. While I won't argue with you with over fly-by-wire versus pilots, Airbus planes have crashed or had near-misses due to the fly-by-wire software.

 

[Tannin]

Nope. Read the literature.

I don't have time to drag out the blow-by-blow this week but you can trust me on this. My family background is steeped in aviation, my father (now retired) was a pilot for 30 years, then an aviation safety consultant to most of the largest civil and military aviation operators in the country for 15 years after that. Wrote textbooks, the whole bit. My brother maintains the family tradition and keeps me up to date. (He's in the UK, flying 757s at present.)

These are ill-informed gross slanders put about only in the USA, and strictly for home-town team reasons. They have more-or-less stopped surfacing these last couple of years, mainly because Boeing has finally dragged itself out of the previous century and (almost) caught up to the industry leader so far as control systems go.

 

[i]

I can't say I've ever heard of any "crashes" or "near-misses" stemming from "fly-by-wire mistakes" with an Airbus aircraft.

Any links?

 

[LiamC]

Good on the hearsay it appears

from here:

http://www.airsafe.com/events/models/rate_mod.htm

Chances of dieing in an Airbus A320 is roughly the same as in a Boeinn 757 or 767 or DC10

You are far more likely to die in a Boeing 727/737/747 or DC9

From here:

http://www.aviationexplorer.com/airline_accidents.htm

you can see the officially recorded cause of crash of just about every major airline disaster. The overwhelming cause is pilot error.

Other sources seemed to indicate that the some "fly-by-wire" accidents were mostly a result of the pilot not being familiar with what the fly-by-wire system would allow--which is more the pilots fault than the systems.

The fly-by-wire crash at a European air-show could be either, pilot error (as officially stated, though far too early to be definitive) or the fly-by-wire system. Enough mystery surrounds this crash to smell of a cover up--so I am less likely to believe pilot-error in this case.

 

[Tannin]

Other sources seemed to indicate that the some "fly-by-wire" accidents were mostly a result of the pilot not being familiar with what the fly-by-wire system would allow--which is more the pilots fault than the systems.

For "some", read at least "most", quite possibly "all". At least in the commercial arena. There were some horrendous FBW accidents in military aircraft, where this technology was pioneered. Airbus & Boeing ddn't get into FBW until years after military aircraft had it, and by that time the bugs (... sorry Tea, "moths") were pretty much sorted.

The fly-by-wire crash at a European air-show could be either, pilot error (as officially stated, though far too early to be definitive) or the fly-by-wire system.

If you are talking about the famous one with a prototype Airbus in France where many people died, that was absolutely all the way pilot error, a litany of bad decisions by a crew that should have known better than to make any of them, never mind all of them. The evidence couldn't be clearer.

Oh no, I see from your context that you are talking about a more recent one. Haven't seen the literature on that one yet.

 

[LiamC]

If you are talking about the famous one with a prototype Airbus in France where many people died, that was absolutely all the way pilot error, a litany of bad decisions by a crew that should have known better than to make any of them, never mind all of them. The evidence couldn't be clearer.

Oh no, I see from your context that you are talking about a more recent one. Haven't seen the literature on that one yet.

The one I was referring to was the June '88 A320 crash. Is this the one you mean?

At least here:
http://www.aviationexplorer.com/a320_facts.htm
& here:
http://catless.ncl.ac.uk/Risks/7.11.html#subj3
seem to imply that something fishy went on with the flight data recorder. The "official" cause (pilot error) was announced 2 days after the crash--but that sounds highly unlikely to me. Coupled with the other irregularities, I will hold an open finding on that one, at least until something more definitive comes around.

 

[Tannin]

Yes indeed. You could not ask for a clearer case of pure, 100% pilot error. The crew embarked on a hastily-planned flyover, at well below the usual minimum safety height, with a load of passengers.

• The flyover height (selected by the crew) was lower than the surrounding obstacles.
• The flyover was conducted at an excessively slow speed. Again, a crew choice.
• The crew switched off the fly by wire Alpha Floor safety feature.
• Despite being below the surrounding terrain, the flyover was conducted with the engines at minimum power.
• The crew finally realised what was going on just five seconds before they flew into the scenery. It takes around 7 seconds to spool an engine up from flight idle to full power.

The in-cockpit conversation between the captain and the first officer - preserved by the Cockpit Voice Recorder which, like the Digital Flight Data Recorder, survived the accident intact - is illuminating:

• At 100 feet. FO: "OK, you're at 100 feet - watch it!" (At this point the crew deactivated the Alpha Floor function - i.e., overrode the computerised flight control system to prevent it automatically applying power as the aircraft slowed and the angle of attack increased.
• At 40 feet and still sinking. FO: "Watch out for the pylons ahead - can you see them?"
• At 30 feet. Captain "Yes - don't worry."

Let's play that last conversation again:

1: "Watch out for the pylons ahead - can you see them?"
2: "Yes - don't worry."
3: ..... crash ......


Five seconds before impact, the captain finally realised that:

• The aircraft was 30 feet off the ground
• It was already below the prescribed minimum safe flying speed
• The engines were at flight idle - i.e., near enough to zero power
• They were five seconds flight time away from the trees

As we all know, it takes longer than five seconds to spool up a modern jet engine. At this point there was absolutely nothing anyone could have done to avoid the crash. No possible manipulation of the controls could get enough power on fast enough to gain enough airspeed to provide the needed lift to clear the obstacle. The crew applied full throttle, but it was too late. When the brand new A320 with 130 passengers on board hit the trees, the two engines were still only spooled up to 83% and 84% of max.

They broke a whole series of routine safety rules and ended up simply flying a brand new aircraft in perfect condition in good weather and broad daylight into the side of a hill.

And this is the sort of "evidence" that Home Town Forever lunatics in the USA stil bring up to support the ridiculous assertion that highly advanced aircraft manufactured in Europe have "unsafe" fly by wire systems.

Trust me on this, Sechs, this well-known accident is a pretty fair sample of the lunatic badmouthing you will have come across. Examine the claimed cases one by one, and while you will not find a clearer example than this one, you will see that it is by no means unusual amongst them.

(Disclaimer: the summary above makes it seem that the captain was a complete nut case, which is not fair to a man with considerable expertise and vast experience who found himself pushed into doing something that he really shouldn't have done, with far too little preparation. Yes, he screwed up big-time and people died, but there were several other factors I have not had room to mention above (all of them having to do with the human situation - i.e., non-technical factors) which helped lead to his error of judgement.)

 

[Tannin]

from here:

http://www.airsafe.com/events/models/rate_mod.htm

Chances of dieing in an Airbus A320 is roughly the same as in a 757 or 767 or DC10. You are far more likely to die in a Boeing 727/737/747 or DC9

Actually, no. Those figures simply report how many people have actually died in those aircraft (usually adjusted on a per-passenger-mile basis, or something similar). They fail to take two very significant factors into account:

1: The non-random distribution of aircraft types. The 727, for example, is a very old aircraft. Almost every 727 still flying is in the hands of either (a) a struggling little low-budget freight or charter airline, or (b) an airline from one of the air safety ghettos of the world - Africa is an obvious example. These guys have horrendous safety records. They don't have the training, the budget, the equipment, the corporate culture, or the know-how to run an airliner safely. As routine, they fly into airports with very poor equipment under conditions that would make a legitimate operator blanch. It doesn't matter what aircraft type they happen to have, they will go on crashing the things year in and year out. It so happens that most 727s can't meet modern 1st world noise regulations without very expensive modifications, so on the second-hand market they change hands for about $10 and a bucket of rice. They wind up in Africa (and other places) and get flown into the ground - in both the figurative and the literal senses.

The 727 was a fine aircraft, one of Boeing's best, and when maintained properly and flown by a competent organisation it is still a fine aircraft. I'd fly on one without a second's hesitation. Ditto the 747, the early model 737 (these are the ones, by and large, that crash - the new gen models are too expensive for 3rd world airlines, and not far off an all-new design anyway) or the DC-9. If, that is, the 727 was flown and maintained by a Singapore Airlines or a Qantas or another airline of similar quality.

2: The effect of random chance on what are by statistical standards very small samples. On the "unsafe" list we see some very good aircraft. The DC-9 and the 747 both stand out as aircraft that are universally regarded as superb examples of their kind by the people who know. Same with the (much more recent) Airbus A320, by the way. Remember the Lockerbie bombing? Someone put a large time bomb on a 747 full of people. The bomb went off, and hey presto! the 747 got an extra 270 victims on its tab. Or the Tenerife disaster when two 747s collided on the runway (through no fault of the aircraft - it was pure human error) and another 583 people were killed in the worst aviation disaster of all time. Once again, if you look at those statistics, the 747 cops the blame.

And then on the "good" list we have, of all things, the DC-10 which, alone and entirely unaided by any significant in-air human factors, was responsible for many hundreds of deaths. This is a superb demonstration of the perversion of statistics. They eventually fixed the terrible faults in the DC-10, and I'd probably feel more-or-less OK about flying on one now (provided it was well-maintained), but prior to the major rework, it was a known, proven deathtrap.

 

[Fushigi]

History's worst software bug.

 

[mubs]

Tannin, have to agree with your last post. WRT to the first link, if you read the "Details on Data and Method" page, they say

The fatal event may be due to an accident or due to a deliberate act by another passenger, a crew member, or by one or more persons not on the aircraft. These events include sabotage, hijacking, or military action and exclude cases where the only passenger deaths were to hijackers, saboteurs, or stowaways.

Italics mine. What??? Why is that the fault of the aircraft?

 

[Will Rickards]

History's worst software bug.

Are you referring to the 404 or windows or microsoft's website or?

 

[Fushigi]

History's worst software bug.

Are you referring to the 404 or windows or microsoft's website or?

I went to microsoft.com/windows, let it redirect me, and copied the resulting link. Windows gets my entry for worst software bug.

Hmm. Looks like the link just needs an 'x' on the end: History's worst software bug.

 

[LiamC]

Yes indeed. You could not ask for a clearer case of pure, 100% pilot error. The crew embarked on a hastily-planned flyover, at well below the usual minimum safety height, with a load of passengers.

I stand corrected, and bow to your superior wisdom sensei.

Was it ever established why he (the pilot) did this?

 

[LiamC]

Actually, no.

My bad. I thought the data was at least normalised for air-miles etc to take into account the discrepancies between say a 727 and 767. Astute comments.

 

[sechs]

you can trust me on this

I have a bridge in California that I can sell. You can trust me on this.

You have made no statement that refutes my assertion (although, I will grant that I have made no serious statement in support of it). There's obviously no point in attempting to reason with someone who starts off by insulting you and then uses fallacious argument.

 

[Tannin]

No insult there that I am aware of, Sechs, certainly none intended. But you can trust me on this matter — it is a field I have some reasonable knowledge of.

I have dealt, in detail, with the one and only case raised in the thread, and stand ready to deal similarly with others that people may care to cite, though I may not have the literature covering the most recent incidents (if any) yet.

If you care to bring some specific charges to support your claim, I'm happy to deal with them in a similar way. Otherwise, you are just repeating the same foolish, vacuous hearsay that some people in the USA have been repeating without the faintest shred of evidence for many years now. (Although I'm not sure that my phrase "have been repeating" is the right way of putting that: it implies that the repetiton is ongoing, which is not really the case. It seems to have died right off in the past few years.)


PS: LiamC's last question (about why the pilot of that A320 f*ed up so badly) is a good one, and the investigation reported on this too. Interesting stuff. I'll summarise that after I get home - memory being what it is, I can't do it without the details in front of me.)

 

[Tannin]

Yes indeed. You could not ask for a clearer case of pure, 100% pilot error. The crew embarked on a hastily-planned flyover, at well below the usual minimum safety height, with a load of passengers.

Was it ever established why he (the pilot) did this?

As ever with air accidents (and with other sorts of accidents too, it is safe to assume) through a long chain of small incidents and factors, any one or even any three of which would usually be harmless, but which added up on this tragic day to a disaster.

When the organisers of the Habsheim airshow invited Air France to conduct a demonstration flight, the company examined several factors according to routine: in particular the clearance available over the closest obstacles to the main Habsheim runway. This was OK. The file containing the approved request only reached the department responsible for supplying an aircraft and crew late in the week prior to the airshow.

The two pilots selected were competent and experenced, well-rested, and trained on the aircraft type. Between them, they were qualified on the A320, A300, A310, Caravelle, 707, 727, 737, and had about 30 years of experience flying jets for Air France. The captain was, among other duties, in charge of training Air France crews for the then-new A320. They were, however, only told about the assignment on the morning of the flight. Neither was familiar with the airport at Habsheim, but because they were so experienced, no effort was made to provide them with any information about the place, not even a map.

The instructions were simply to transit from Charles de Gaulle (Paris) to Basle-Mulhouse, attend a press conference about the new aircraft, take on 130 passengers for a sightseeing tour of the Alps, then take off, remaining at 1000 feet for the very short trip to Habsheim, descend to fly a low-speed pass along the main runway, accelerate, climb to a safe height, turn onto a reverse course and repeat the pass in the opposite direction but at high speed, then continue on to Mount Blanc for the sightseeing.

On paper, Air France regulations required that such flyovers be conducted at a minimum height of 170 feet, but it was a longstanding normal practice within the company to actually fly them at 100 feet (to provide a better view for the spectators).

The captain flew the aircraft. As it took off, he explained his intentions to the FO: fly slowly towards Habsheim and, as soon as they had found it, lower the flaps and undercarriage, and descend to 100 feet for the slow pass. When the aircraft reached its maximum angle of attack (i.e., lowest possible flying speed) the captain would switch off the Alpha Floor function to prevent the flight computer from putting on extra power when the AOA got to 15 degrees, and the FO would use the throttles to maintain speed and height. The FO, according to the tapes, seemed doubtful of this proceedure, but the captain said "I've done it 20 times!" At the end of the slow pass, the FO was to apply takeoff power and the aircraft would accererate and turn away spectacularly, ready for the fast pass.

After finding Habsheim airport a little later than expected (only six miles away, which is not far at all in a jet aircraft), they descended rather faster than intended to "catch up" with the plan. At 450 feet, with the airfield clearly in view, they realised from the position of the crowd that the airshow organisers had laid the show out alongside the second, minor runway, which crosses the main runway at right-angles. They had not mentioned this in the paperwork, and no-one at Air France had thought to ask. This required a hasty unexpected turn and did not leave the crew time to stabilise the descent as planned. The upshot was that the aircraft arrived over the end of the runway still decelerating, already below the planned height of 100 feet, still sinking, and with the engines still in flight idle.

OK, we all know that when we start doing things at the last moment (think of a sudden lane-change on the freeway) we tend to get a little untidy. But how did a crew as experienced as this get it so out of shape, and why didn't they realise what was happening until it was physically impossible to do anything about it? There were several factors:

* Neither crew member was familiar with Habsheim.
* The crew did not recognise the trees as anything other than a block of something that was a different colour to the grass of the airstrip until they were actually below them.
* The extraordinary extra flight control safety margin offered by the flight computer itself led to over-confidence. (Especially dangerous when you deliberately switch off the safety system!)
* The captain had done many demonstration flights previously - but all over runways 2000 or 3000 metres long with 100 foot control towers. Habsheim's grass strip was 650 metres long and its control tower only 40 feet high. This could easily lead to mistaken perceptions of height and distance.

It's a long, long chain of causative factors: haste, overconfidence, holiday atmosphere, unfamiliarity .... each one added its own little bit to the brew. Any one of those things could have been a little bit different and the accident would never have happened. Accidents are usually like that.