Å®ÉúСÊÓƵ

Computer systems in fly-by-wire aircraft such as the Airbus A320 could
be inherently unsafe because of a quirk of technology, a British scientist
claimed this week.

The argument rests on the method used to translate analogue data from
sensors, such as those that measure the angle of the wing flaps, into a
digital form that the aircraft’s processors can handle. Mike Underhill,
head of the Department of Electrical and Electronic Engineering at the University
of Surrey, warns that in some cases different processors on a plane could
record different values for the same piece of analogue data.

What is worse, he says, there is no way that the software controlling
the plane could be written to identify the anomaly. And the problem would
be made worse by installing more powerful processors which gather data more
frequently.

Despite the increasing number of fly-by-wire aircraft, pilots remain
suspicious of them. The first computer-controlled commercial passenger aircraft,
the Airbus A320, was introduced in 1987. Since then, four have crashed.

Pilots flying the A320 do not have direct control of flight surfaces
such as the rudder and flaps. Commands are mediated by five on-board computers
which decide whether a manoeuvre is beyond the aircraft’s capability. Some
pilots have claimed that the system ignored their commands or reacted slowly.

Underhill’s argument centres on an electronic circuit known as a flip-flop,
which is commonly used to convert analogue data into digital form. An analogue
sensor translates a variation in the angle of a flap, for example, into
a proportional change in voltage. But the A320 needs this information in
digital form.

The flip-flop has two stable states. When the input voltage is low,
its output voltage is low – a signal that corresponds to a digital 0. But
when the input voltage rises above a certain threshold, the circuit flips
to its other state, and the output voltage rises to a higher value – a digital
1. This remains constant until the input voltage falls again below the threshold.

The aircraft’s processor checks the flip-flop’s output every time it
needs an update. But, says Underhill, if it does this too soon after the
circuit flips, there is a finite chance that it could check the output just
as the circuit changes between its two states – and is giving neither 1
nor 0. ‘If the processor interrogates the flip-flop at this stage, it will
get an uncertain datum. By looking at its value, you probably ‘force’ it
one way or another into an ‘answer’,’ he says. If two different processors
interrogate the same flip-flop at this stage then one might record a 1 and
the other a 0.

‘These two different values – for the same event, remember – can then
propagate through the computer, and there is no way for the software in
the processors to know that they conflict,’ says Underhill.

He says that although the probability of such an event is low – perhaps
1 in a few million – the processors check the flip-flops thousands of times
a second. ‘That brings the chances down to about 1 in 1000.’

The problem would be made worse by installing more powerful processors
which interrogate the flip-flops at even shorter intervals, because they
would be more likely to catch the circuit during a state change.

The conflict is most likely to arise when analogue values are changing
fastest because the aircraft is manoeuvring rapidly. Crashes involving the
A320 have come at such times, though this is also the time at which pilot
error – the cause of most air accidents – is most likely.

Underhill says the problem, if it does arise, can be cured. Every flip-flop
has a ‘critical period’ needed to change state completely. The solution
is to make the processor wait a certain time between interrogations. Underhill
says this delay needs to be 150 times the critical period.

‘I haven’t taken this further, but I have convinced myself that it’s
a fundamental problem which makes fly-by-wire planes fundamentally unsafe
. . . ,’ says Underhill. ‘The solution is known and written down in certain
textbooks. But my belief is that it may not be being used.’

Airbus was not able to comment before New Å®ÉúСÊÓƵ went to press.