Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×
Bug Transportation Technology

Boeing 787 "Blacklisted" From Some Air Traffic Control Services (flightglobal.com) 96

Posted by timothy from the flight-oh-oh-nine-please-repeat-your-position dept.
An anonymous reader writes: A software glitch causes the Boeing 787 to report its position incorrectly, which has led Australia and Canada to 'blacklist' the aircraft from using ADB-S and until it is resolved the latest Boeing is treated as an aircraft without ADS-B capabilities. The practical implication is that the aircraft is not allowed to use reduced separation procedures and an maximum altitude limit of 29,000 feet was also considered. Boeing denies that the bug causes a safety hazard because existing services (radar) still allow safe operation. A bugfix is coming to restore ADS-B functionality.
This discussion has been archived. No new comments can be posted.

Boeing 787 "Blacklisted" From Some Air Traffic Control Services More

Boeing 787 "Blacklisted" From Some Air Traffic Control Services

Comments Filter:

  • It's not really a blacklist then, is it? (Score:3, Insightful)

    by halivar ( 535827 ) <`moc.liamg' `ta' `reglefb'> on Tuesday December 15, 2015 @09:57AM (#51121149)

    It's graceful degradation.

    • Re:It's not really a blacklist then, is it? (Score:5, Informative)

      by Anonymous Coward on Tuesday December 15, 2015 @10:12AM (#51121269)

      It's graceful degradation.

      No, a graceful degradation would be the plane recognizing it's not operating correctly and falling back to the older service. This is a case where the plan is actually trying to use the newer/better service, failing to do so correctly, and it not aware that it is failing to do so. The humans involved are noticing the error and have had the blacklist the plan from the newer system and manually force a fallback to the old system.

      I mean seriously, the second sentence in TFA even says:
      Boeing says a service bulletin with instructions for operators to correct the position reporting error will be released “imminently"

      • Re: (Score:1)

        by Anonymous Coward

        no, it's one data type that's blacklisted, and the ATC system gracefully reverts to radar data as designed.

  • at least is not tcas off (Score:3)

    by Joe_Dragon ( 2206452 ) on Tuesday December 15, 2015 @10:09AM (#51121255)

    as that can end deadly.

    • Re:at least is not tcas off (Score:4, Interesting)

      by digitig ( 1056110 ) on Tuesday December 15, 2015 @10:21AM (#51121343)
      I'd be interested to know where the glitch is. If it's just in the ADS-B system then with the restrictions in the article it just costs time and money. But if it's in the navigation system then the aircrew and TCAS will have wrong information about where the aircraft is, which is far more worrying.

      • Re: (Score:2, Interesting)

        by Anonymous Coward

        From what I gather the pilot/co-pilot are receiving the correct information, the article notes one of the first instances where the issue was noticed "The controllers alerted the crew by radio, but the pilots insisted their instruments showed they were still on course." It sounds like there is a system to pass information from the aircraft system to a separate ATC-B beacon, for some reason that system under some circumstances only passes the lat or long, not both. The ATC-B beacon then has another (what I

      • Re:at least is not tcas off (Score:5, Informative)

        by DesertNomad ( 885798 ) on Tuesday December 15, 2015 @12:49PM (#51122505)

        I run a number of ADS-B receivers and feed the data into FlightAware. I have seen a number of a/c locally that are in very wrong positions (well over the 70 km mentioned in TFA) and suddenly jump into the "right" positions. Sounds like interface problems.

        The ADS-B system is fairly simple, and as long as the right lat-lon string is inputted, it should transmit the right position. Maybe it's a "units" issue similar to the "units" issue that caused the Mars spacecrafts more than a decade ago to make an unexpected and unfortunate (very) hard landing...

        • Re:at least is not tcas off (Score:4, Informative)

          by parkinglot777 ( 2563877 ) on Tuesday December 15, 2015 @02:51PM (#51123691)

          Here is the cause on the TFA (which is what Boeing said)...

          In rare cases, after passing a planned turn upon crossing a waypoint, the data packets that arrived at the transponder would contain either the aircraft’s latitude or longitude, but not both. In those cases, the ADS-B transponder’s software would extrapolate the 787’s position based on the previous flight track before it made a planned turn at a waypoint. It would continue reporting the aircraft erroneously on the incorrect track until it received a data packet containing both the latitude and the longitude of the aircraft.

          • Ultimately, this appears to be an issue with data atomicity. If the function is dependent upon receiving both lat and lon information, then from an architecture standpoint, the containerization of that data should be structured to be atomic if possible. However, the he network design may be using ARINC-429 words which are only large enough to contain lat or lon data, but not both. A possible fix would be to use a larger network data object (NDO) that contains both pieces of data if the network supports i

            • Re: (Score:2)

              by PPH ( 736903 )

              Otherwise, the design would need to be improved to mitigate or improve the handling of situations where only 1 piece of lat/lon data is available.

              This is a good point. And it seems that the existing design accounts for the loss of one piece of data by the use of an estimation algorithm. This algorithm is the one that takes the last known heading and 'projects' an assumed position (sometimes incorrectly) along that route.

              But here's the problem: That estimation algorithm is a Boeing-built (or subcontracted) piece of software, which means that it is tightly coupled to its data source. And rather than ensure that the bandwidth exists between avionics co

        • Re: (Score:3)

          by nadaou ( 535365 )

          The problem is incomplete messages being broadcast. Sometimes the lat is missing, sometimes the long is missing. In these cases the system was using dead reckoning to extrapolate the missing value based on the previous ones. Not ideal but roughly giving you the right answer when traveling in a straight line. Gives the wrong answer after turning at a waypoint. When a complete message finally does make it through the plane jumps back to it's correct position.

        • Maybe it's a "units" issue similar to the "units" issue that caused the Mars spacecrafts more than a decade ago to make an unexpected and unfortunate (very) hard landing...

          TFA explains what the error is. It's a missing lat or lon in data being sent to the ADS-B system by the internal packet data network, and the system is interpolating the missing data until correct data is provided. The problem appears most after the aircraft has made a course change ("turn") at a navigation waypoint, because the interpolation doesn't know about the turn and continues straight ahead.

          It's not an error in the navigation systems, and the pilots know where they are. The ground-based radar knows

  • So the plane tells ATC where it is... (Score:3)

    by Viol8 ( 599362 ) on Tuesday December 15, 2015 @10:12AM (#51121271) Homepage

    ... instead of ATC relying on radar. What could possibly go wrong?

    • Re:So the plane tells ATC where it is... (Score:5, Informative)

      by brambus ( 3457531 ) on Tuesday December 15, 2015 @10:25AM (#51121377)
      I know you were trying to be snarky, but you did accidentally ask a good question where the answer isn't trivial:
      • Since the dawn of radar ATC, civilian radar has been SSR - Secondary Surveillance Radar, meaning, it requires cooperation from the aircraft. SSR gives you the horizontal location of the target, but not its elevation. Instead, together with the actual radar return, the aircraft responds using a short digital code that identifies it and tells you its altitude (as read from the onboard altimeter by the SSR equipment on the aircraft). SSR has numerous advantages over PSR, mainly its not as complex, doesn't require as much power and has greater range, all of which are useful in a civilian environment. Also, it has no military application, so it carries far fewer export concerns.
      • Even so, SSR is still very expensive and providing good coverage is difficult to impossible. Even modern industrialized countries such as the USA have many places where radar coverage is simply unavailable (especially at lower altitudes). In less well of places, such as large areas of Africa, radar coverage is nonexistent.
      • The vast majority of all aircraft (and nearly all commercial aircraft) have some sort of navigational equipment that is completely independent of radar coverage and is reasonably accurate to provide traffic separation services. Put simply, aircraft are able to navigate without any ground assistance.

      And so the natural evolution is to largely abandon SSR (except for areas of extremely high traffic density) and instead place around the country only small receiver stations that listen to aircraft position reports. Using those then, ATC can build a complete traffic picture and provide separation services without having to maintain expensive ground equipment.

      • Re: (Score:3)

        by Viol8 ( 599362 )

        "Using those then, ATC can build a complete traffic picture and provide separation services without having to maintain expensive ground equipment."

        Until some pilot decides to switch the transponder off and the plane effectively becomes invisible. But that would never happen. Oh , wait...

        • ADS-B Out, which is the system I'm talking about, cannot be switched off. It becomes active as soon as the avionics stack is powered up.

          • ADS-B Out, which is the system I'm talking about, cannot be switched off.

            I guarantee it can be switched off. You might have trouble switching it on again, but then, the guy who turned it off may not care much about that.

            • I'm trying to talk simple language here to people who are not into aviation. I'm not trying to imply you can't switch it off for nefarious purposes. Btw: SSR wouldn't help you much there either. You see a blip on the radar that doesn't communicate with you and doesn't give ID or altitude. Good job. What now? You are not the air force. Your job is not to secure the border. If you have security concerns you call the people who have the equipment that doesn't care if the target cooperates. You'd do exactly the

          • ADS-B Out, which is the system I'm talking about, cannot be switched off. It becomes active as soon as the avionics stack is powered up.

            What happens if I:

            1) Hit the "off" button on my Garmin GTX-330 ES (1080 extended squitter)?
            2) Pull the breaker?
            3) Turn off the GPS that is feeding it data?
            4) Similar stuff if I have a 978 UAT ADS-B out?

            Sure *seems* like I can turn it off if I want to. I'd be breaking a rule for sure, but not sure what you think prevents me from turning it off?

            • I should have qualified that a bit:
              1) I was trying to primarily address large transport aircraft and issues of flight safety.
              2) I'm NOT trying to address attempts at tampering.
              Obviously as soon as you start pulling breakers, we're well past the accidental disconnection stage. SSR wouldn't help you here much either from the POV of ATC. What would you expect ATC to do with it if an aircraft intentionally disables the transponder? Fire missiles at the uncooperative aircraft? They have buddies wearing green

              • Ok, fair enough. Previous poster said "Until some pilot decides to switch the transponder off" which to me meant "decides to intentionally switch the transponder off" and I thought you were saying that wasn't a possibility. Even in a transport category aircraft, I'm sure the pilot can pull the right breakers if he wants to go invisible.

                I'm not sure that ADS-B was really designed with anti-hacking in mind. It seems to be designed to work as long as everybody is playing nicely. I'm wondering how long it will

                • Ok, fair enough.

                  My bad sir. I should have been more clear.

                  Even in a transport category aircraft, I'm sure the pilot can pull the right breakers if he wants to go invisible.

                  At present they can. We'll see about the evolution of the ATS. Maybe in the future as SSR is further reduced and self-reporting becomes more well tested, things such ADS-B might become mandatory always-on features and we'll see battery-powered kits installed into aircraft that cannot be switched off.

                  I'm not sure that ADS-B was really designed with anti-hacking in mind. It seems to be designed to work as long as everybody is playing nicely.

                  All of ATS is traditionally very much a gentlemen's club. There's nothing stopping you from hopping into your nearest non-transpondered non-radioed Supercub and generall

      • So at basics it is a trust relationship with the aircraft to provide accurate altitude and positional information?

        The article is about specific model but is there not scenario for a small drone to lie and pretend position? I couldn't see anything in spec about shared verification.

        • The civilian ATS (Air Traffic Service) is not designed to deal with openly hostile aircraft. That's what the Air Force is for. Also, SSR isn't anywhere near sensitive enough to resolve small objects like drones. I know most people in the public at large think the national airspace is tightly controlled, but it really isn't like that. The highly controlled parts (e.g. in the vicinity of major airports) are the significant minority. Even places you might think of are tightly regulated (e.g. over most cities w

  • Not a safety hazard? My ass! (Score:5, Insightful)

    by LordKronos ( 470910 ) on Tuesday December 15, 2015 @10:16AM (#51121301)

    Nav Canada first detected a problem on 1 July 2014 when controllers noticed a 787 appearing to deviate up to 38nm (70km) from its planned track. The controllers alerted the crew by radio, but the pilots insisted their instruments showed they were still on course. Suddenly, however, the 787 “was observed jumping back to the flight plan route” on the controller’s screens, according to ICAO documents.

    I'm sorry, but if a plane is reporting that it is 70km from where it actually is, that's no small deviation. That deviation is more than 10 times the required flight separation. It may not pose a safety hazard once controllers already know they have to fall back to the older system. But before this was discovered? That's a HUGE safety hazard. The only reason they can get away with claiming it wasn't a safety hazard was because they lucked out and the system only screwed up when there were no other planes around

    • Re: (Score:1)

      by Anonymous Coward

      I don't know, 38 nano-meters is a pretty accurate reading.

    • Re: (Score:1)

      by PRMan ( 959735 )

      38 nanometers = 70 kilometers?!?

      I thought you Euros said this metric thing was easy!

    • Re: (Score:2)

      by sjames ( 1099 )

      That and when it reported the wrong position, it was implausibly far from the true position. It's much worse when the error is plausible.

    • But before this was discovered? That's a HUGE safety hazard.

      An aircraft being 70km from where it is supposed to be with nobody knowing it is a huge safety hazard, both to that aircraft and others.

      But an aircraft being exactly where it is supposed to be, with the pilots knowing where it is and that it is where it is supposed to be, and ATC being told by the pilots it is where it is supposed to be, is not a huge safety hazard to anyone. ATC issues clearances based on the assumption that aircraft will be where they are told to be, so an aircraft that is where it was

  • The underlying problem ... (Score:5, Interesting)

    by PPH ( 736903 ) on Tuesday December 15, 2015 @11:05AM (#51121665)

    ... is that the problem was traced back to the 787 avionics network. Information sent from the GPS (where the data originates) to the transponders (where it is sent out to air traffic control). This is the same network which attracted attention when Boeing asked for a special condition [federalregister.gov] exempting the 787 from a requirement to isolate critical functions from things like the passenger entertainment system. Now, nobody has tracked down exactly what caused this communications glitch. And they may never do so. But their innovations may be coming back to bite them in the ass.

    • Looks like you are saying "FAA requires airplanes to isolate flight critical info network from other less critical networks like the entertainment system. Boeing wanted a waiver to mix the traffic."

      Is my understanding correct? Did FAA give Boeing the waiver it sought? Did Boeing take advantage of this waiver and mixed the traffic?

      78 nautical miles is almost 10 minutes at cruise speed for 787. It can't be simple network delay or latency. It has to be some severe buffer overflow underflow issue with some

      • Re: (Score:2)

        by PPH ( 736903 )

        Is my understanding correct? Did FAA give Boeing the waiver it sought? Did Boeing take advantage of this waiver and mixed the traffic?

        Yes.

        Did this mixing of traffic result in the dropping of some GPS packets? I don't know. But if Boeing's example of error handling in this case is any example of their competency in managing critical systems in general, I'll be taking a train.

  • "an maximum altitude" -- typo, or Euro-grammar gone too far?! It's getting so hard to tell anymore.

  • bugfix? (Score:4, Funny)

    by HideyoshiJP ( 1392619 ) on Tuesday December 15, 2015 @12:15PM (#51122207)

    "A bugfix is coming to restore ADS-B functionality."

    $adsb.model = "777-200ER";

  • Perhaps the bug is really a hidden feature, only revealed by accident. ( This is a shoe in for a Bruce Schneier's Movie Plot Scenario )

    Deeply buried in the ADS-B firmware is an emergency setting which, should the Department of Homeland Security get a credible security theatre warning that criminals with smartphones and GPS guided drones are planning to bring down airliners. All airliners with updated ADS-B firmware will report their position as exactly 70nm away from their real position on a pseudo-randomly

  • I log ADS-B traffic to a PostGIS DB, and as part of the deduplication and data cleaning process, I look at the position reports, time & distance between them and the logged speed to see if they make sense. I sometimes have to add a fudge factor of up to 50km. ADS-B packets can get corrupted in ways that dump1090 can't fix up or detect, and I thought that the errors were due to that. Dump1090 has its own quirks when you're pulling position reports down from its JSON interface, but it's easier than pullin

  • ADS-B has zero security controls. Someone with a simple transmitter could draw a murder of giant dicks swarming in three dimensional space using A-380s as pixels. It's hilariously bad.

    • Even better, I can make my plane NEVER violate any restricted area, speed restriction, crossing restriction, or anything else I don't want it to do. I can make it always be 500 feet left of where I really am. I can make it take off for LAX at 1500 knots if people complain about what I am doing. I can make myself the leader of a 500 plane formation that spells BITE ME.

  • Tsk tsk (Score:2)

    by GoRK ( 10018 )

    FOR SHAME! It's ADS-B not ADB-S.

Slashdot Top Deals

Beware of Programmers who carry screwdrivers. -- Leonard Brandwein

Close