What Happens to Fly-by-Wire When Someone Pulls the Plug?

WHAT HAPPENS TO FLY-BY-WIRE WHEN SOMEONE PULLS THE PLUG? by Charlie Martin

Air France Flight 447. It’s the worst of nightmares in the airline industry: a full flight, no sign of trouble, and then the aircraft disappears from radar over the ocean. It happened in 1996 with TWA Flight 800, and it happened again last night.

Most commercial air accidents have pretty obvious immediate causes: something fell off, or something hit the plane. A year-long investigation will eventually show that there was a sequence of mistakes and failures, none enough to cause a crash in itself, but fatal in combination. This sort of mid-air, single-plane mystery is much harder, and will be made more difficult still because it will be very difficult or impossible to recover much of the plane. The Atlantic is very deep there, more than 20,000 feet.

This one is certainly mysterious: automatic warnings were sent by the plane that there were problems, but there was no hint of a message from the pilots, no distress calls, and minutes later the aircraft disappeared completely.

It’s probably too early for the speculation to start, but that won’t stop anyone. In this case, particularly, I can’t help but speculate, because of a small personal connection.

Back in the late 80’s I was consulting at NASA during graduate school, working on reliability modeling for aircraft. When we think of NASA, we always think about the Space Shuttle, Hubble Telescope, and astronauts. We forget that NASA also does research and development on aircraft that stay in the atmosphere. In this case, we were interested in pure “fly by wire” aircraft.

In small airplanes, when you turn the wheel, it moves wires or pushrods. Most of the time in bigger aircraft, turning the wheel pushes the control surfaces through hydraulics, and while there may be some power assist (like power steering) it’s still a direct connection between pilot and airplane.

In a fly-by-wire aircraft, that’s all gone – the pilot pushes the control, and it becomes an input to a computer that adjusts the control surfaces to match. Some fly by wire plans have auxiliary systems to help the pilot if the computers do fail, but in a pure fly by wire plane, that’s all gone.

Obviously, in a fly by wire plane, it’s considered very undesirable for the control computer to fail. It crashes, literally. We were using mathematical models to explore how reliable a fly by wire system could be made. Could it be as reliable as the rest of the airframe itself?

The results at the time were that it certainly could be made as reliable as a fighter plane – fighter pilots break those pretty regularly, even if no one is shooting at them. In general, the chances are about 50-50 that there will be a fighter aircraft failure for every 100,000 hours of flight time. But commercial aircraft are a thousand to ten thousand times more reliable: you should be able to go a billion flying hours or more before the actual aircraft will fail.

So the question was, could flight computer systems be made as reliable as a commercial aircraft? And the carefully considered answer, after several years of work and immense amounts of modeling, was: we don’t know.

The truth is that computers aren’t like wings. They don’t fail when you bend them too hard, they fail when the complicated instructions in the computer hit some condition no one ever thought about. Of course, you can try to solve that by having multiple computers, say three, and taking a majority vote. Then you’re depending on the computers’ programs being diverse enough to not fail the same way on the same inputs, an assumption called n-version programming. That has its own problems, though: experiments done by John Knight and Nancy Leveson about that time showed that independent groups of programmers working from the same requirements tend to make a lot of the same mistakes. In other words, the three computers might very well agree on the wrong answer.

What does that have to do with the Airbus 330, you ask? Simply, the Airbus 330 is one of the few commercial aircraft that is completely fly by wire. The Airbus 320, or Hudson River fame, has mechanical backups, but the Airbus 330 and 340 don’t. And that’s the root of my speculation. If something happened to cause all the computers to fail at once, or cause all electrical power to fail, the pilot and passengers are pretty much out of luck.

What could do that? The obvious answer is lightning. Aircraft are actually damaged by lightning very rarely, but lightning can be a capricious beast: protect yourself against all twelve ways that lightning could harm something, and lightning will find a thirteenth.
Soon enough we’ll know more – or maybe we won’t. But back in the 80s I promised myself that I wouldn’t fly in the fly-by-wire Airbus, and I’ve pretty well kept that promise. The loss of Air France 447 may be why.