On October 30, a JetBlue flight from Cancún to New Jersey suddenly nosedived mid-flight, before the pilots were able to correct its course a few seconds later. After making an emergency landing in Florida, some passengers received medical attention. Following this incident, Airbus had to urgently update flight control software in 6,000 aircraft in the A320 family. There was talk of a “disruption caused by a single particle” and the role of solar flares. What’s the story?
The workaround proposed by Airbus is to roll back certain flight control software to a previous version. On specialized forums, there is speculation about the technical causes of this malfunction, particularly regarding features that may have been added between these two versions and that might not be sufficiently protected against the effects that cosmic radiation can have on computer components. It is best, however, to wait for the official report on the investigation intothe incident. In the meantime, we can revisit the explanation that has been put forward and consider why it might be surprising.
Cosmic rays: the enemies of our electronic systems
Earth is constantly bombarded by particles from space—from the Sun or from more distant celestial bodies. Most of these particles are deflected by the Earth’s magnetic field, while others are absorbed or transformed by the atmosphere; however, some of them can reach the Earth’s surface. They contribute to natural radioactivity and are more abundant during periodsof solar flares.
These particles coming from space have various effects. In the polar regions, which are less protected by Earth’s magnetic field, they cause magnificent auroras in the night sky. They are also believed to cause the flashes of light that astronauts perceive in their eyes. Since these particles constitute ionizing radiation, they can have health effects. For example, during his six-month stay on the International Space Station, Thomas Pesquet far exceeded the maximum annual radiation exposure limit permitted for a French worker.
Particles from space can cause malfunctions in electronic circuits. For example, in the 1990s, power electronic components—particularly those designed for trains—were burning out for mysterious reasons. To narrow down the various hypotheses being considered, these components were tested both on the surface and in a salt mine, 140 meters below rock: the problems did not occur in the mine! Once the problem was identified, it became possible to design components and operating procedures that were much less vulnerable.
What is a disturbance caused by a single particle?
It is more common for particles to alter data stored in a component rather than to burn it out. Computers store information as 0s and 1s, and a particle can cause a 0 to flip to a 1 or vice versa—a phenomenon known as a “ single-event upset.”
In 2003, in the Belgian municipality of Schaerbeek, a political party received exactly 4,096 more votes than necessary in an election—a figure that corresponds exactly to the flip of a 0 to a 1 in a binary number. Such a flip could be explained by a single-event upset.
Of course, countermeasures have been developed, especially for aerospace applications, which are particularly vulnerable. Some of these countermeasures are hardware-based: for example, RAM can be equipped with error-correcting codes based on specific hardware designed to encode and decode data very quickly. This is usually the case with the RAM in servers—the machines that store data in data centers—but not with desktop or laptop computers, due to the cost. These codes make it possible to reliably correct certain errors and, in other cases, at least signal that something has gone wrong.
Other countermeasures are software-based: performing certain checks on a regular basis, duplicating data that needs to be retained for long periods, avoiding storing data for too long in vulnerable storage media, recording certain important information in such a way that altering a single digit results in an absurd—and therefore detectable—value… The possibilities are numerous. There are also testing protocols, including one that involves placing the circuits in the beam of a particle accelerator (a large instrument used in physical sciences).
Electric flight controls affected by a malfunction
Let’s now look at the implications for aviation. Historically, the transmission of commands from airline pilots to their control surfaces—the moving parts of the aircraft that control its flight path—was achieved through fairly complex systems of cables, pulleys, or hydraulic circuits. Redundancy must also be ensured—that is, multiple transmission methods must be provided in case of failure. Since the 1980s, new aircraft models have used fly-by-wire systems, meaning that these mechanical transmission systems have been replaced by wiring and electronic control units.
These computers reduce the pilot’s workload (by automating actions that pilots would otherwise have to perform manually) and thereby increase safety. They can check whether pilots are initiating a maneuver that would take the aircraft outside the range of maneuvers it can perform safely, and can, for example, prevent a stall. The malfunction that led to the recall of the Airbus aircraft involves a computer called the ELAC, which controls the elevators and ailerons—control surfaces located on the aircraft’s horizontal stabilizer and at the rear of the wing tips, respectively.
The flight controls are particularly secure
One thing that can reassure us right away is that problems caused by particles from space tend to occur at high altitudes, where there is less protective atmosphere, whereas the most dangerous stages of a flight are takeoff and landing. However, this does not excuse the malfunction that was observed. Let’s take a closer look at why this problem should not have occurred.
Computerized civil aviation flight control systems are classified, in accordance with international civil aviation standards, into five levels of criticality, based on the severity of the potential consequences of a malfunction: from Level A, where a malfunction could cause an aviation disaster, to Level E, where there would be no consequences for the aircraft’s safety. Electric flight controls are classified as Level A and are therefore subject to the most stringent standards. It is therefore reasonable to assume that the flight controls on the A320 are equipped with mechanisms to detect and/or correct malfunctions, including those caused by radiation.
On the Airbus A330/A340, for example, there are two levels of flight control systems: primary and secondary. There are three primary control units, and when one unit experiences a problem, it is temporarily deactivated—this is not a problem, since there are two others to take over. If there were a widespread issue with the primary controls, the aircraft could operate using the secondary controls, which use different types of components.
Each primary flight control unit consists of two computers: one that controls the control surfaces, and the other that monitors the one in control—they must produce roughly the same results; otherwise, the system detects that something is wrong. Normally, in such a system, if one of the computers malfunctions, the problem is quickly detected, the unit is deactivated, the system switches to the other one, and a crash like the one that occurred in October is impossible.
Why didn't the systems detect the problem?
I personally worked onthe Astrée static analyzer, a tool designed to ensure that control software never enters an error state. It has been used, in particular, by Airbus on its electric flight control systems. Over the years, I have come to appreciate this company’s professionalism and commitment to adopting state-of-the-art approaches in software technology, particularly in the area of formal verification.
More recently, I have also been working on countermeasures against computer malfunctions deliberately caused by electromagnetic radiation. There is, in fact, a possibility that individuals could deliberately induce system failures in order to exploit them for fraudulent purposes; therefore, it is necessary to work on preventing such attempts involving smart cards and other secure devices.
The hypothesis that this was indeed a disruption caused by a single particle remains plausible, but it is surprising that it took several seconds to resolve the issue. The safety system of the control unit affected by the radiation should have detected the incident; the affected unit should have been automatically deactivated, and the aircraft should have switched to a backup unit. We must therefore wait for further information to determine whether this is the correct explanation—and how it could have happened—or whether other scenarios should be considered.
