Some American Airlines planes are grounded because the pilots’ iPads crashed
qz.com
qz.com
(The iOS enterprise in-house code signing certificates, which only Apple can issue, always seem to come with 1-2 year hard expiration dates)
Not a problem, really. FAA regulations require all sorts of backups and emergency procedures. Even my dad's little four-seat general aviation plane has backups for every critical instrument.
This issue prevents you from taking off (out of caution), but if it happened in-flight everyone'd know what to do.
Yes, it would be non-optimal if an aircraft had an issue without a handbook, but assuming that communications haven't been lost, someone on the ground can easily read out items.
[0] http://www.boeing.com/news/frontiers/archive/2006/april/i_ca...
If only a couple planes pester ATC then the system will keep up. It would be safe enough. What are the odds of an inflight emergency requiring a diversion at any instant? Pretty low. So if it happened to one plane they'd figure it out verbally. However requiring all ATC and all pilots to talk over all maps at all landings isn't scalable.
Something similar happens with manuals. One plane loses a system and its ipad, you call home on the radio or satphone or contact a fellow pilot on 123.45 MHz or call ATC for help. This doesn't scale to every plane in the air at the same time for every mostly minor maintenance writeup. Maybe you can ignore error messages this flight, after all most measurable things are not important, just like in business. Or maybe engine code 3141Z.kjdf.subsection2 means the engine is about to explode on the wing, but you've got no manuals...
Something often overlooked is megacorp analysis paralysis. You'll be formally written up if you don't file an engine operation temperature profile thingy form or some meaningless catering receipts or whatever according to boring corporate policy, and it will be brought up at your annual performance review, affect your promotion chances, etc. This scales pretty well when one ipad breaks and you use the copilots ipad or call your boss and argue and he issues you an indulgence or the boss takes dictation of the form for you or you refuse to fly (its only one flight after all). This doesn't scale well when every ipad in a company stops working.
Personally, if I were in a plane over water and I lost all my papers out the window, no fuel estimates, no weight and balance, no maps, no flight plan, no list of obstacles, no nav plan, no notes, nothing at all, I'd probably panic and head for the closest coastal airport (and where is that, without any docs?) If one plane does this, it scales VERY well. ATC calms you down, vectors you in, gives you some geographical advice, and you land. If every plane in the air does this simultaneously, you'll overload ATC and probably get someone killed.
This applies everywhere to all industries not just planes.
Etymologically there's no good word for map (mappa meant napkin, charta meant a sheet of paper) but 'tabula' was used in Classical times.
Aeronautical charts extrapolate from this because being in command of an aircraft is really just commanding a different kind of vessel. Port, starboard, manifest, fix, captain, first officer, and hull are all valid aviation terms, for example, with roots in the sea. A chart is not a map.
We've already had a test run for this, and it worked fine. 9/11 involved exactly that scenario - every flight in or heading to the US had to make for the nearest airport and land immediately.
Imagine if the speedometer in your car failed. You shouldn't drive it until you get it fixed, but it won't kill you if it happens while you're on the highway.
For (made up example, I don't know anything in particular about aviation, but know the general approach from working with controls for nuclear powerplants) navigation one might conclude that GPS and old-fashioned UHF radio navigation is technologically different enough that an event taking down one means of navigation (say, jamming of GPS at 1.5 GHz, spread spectrum, digital, ...) will not affect UHF radio (at analog modulation on a few hundred MHz). So one decides that you have GPS and UHF, displayed on different monitors/indicators, powered by separate power-busses in the airplane.
For paper documentation, they'll probably claim: Bring two binders with the procedures to the plane, store at different sides of the cockpit.
For iPads one might have decided that they must not be connected to any network while on the plane, so that data cannot be deleted from the pilot's and first officer's devices. But have they considered the "common cause failure" of two iPads, not being connected to any network, not communicating with each other, with full batteries, probably with passed selfchecks (checksums for stored data on the flash)... to really fail at the same time because of an expired certificate?
user mode programs causing power down is not an app bug
Of course, from the point of view of "can't be used" it is the same.
Now, why would Jepessen be doing something "funny" and powering down iPads is the answer I want to hear.
That seems to be inaccurate. American Airlines confirms "several dozen flights" which is probably less.
http://www.theguardian.com/technology/2015/apr/29/apple-ipad...
And the fix was available through nearest Wi-Fi. Leaving cockpit a few minutes. The horror!
"In some cases, the flight has had to return to the gate to access a Wi-Fi connection to fix the issue. " http://www.theverge.com/2015/4/28/8511993/ipad-issue-grounds...
For an airliner, yes, the horror.
Why would you want to downplay the dangers of pilots losing access to their flight manuals?
If it happens at an actually critical time, they can have the ATC read the relevant sections to them.
Nothing safety critical would have been entrusted to the iPad. The pilots would be able to deal with the problem with either ATC support (anything the pilots can read to each other, ATC can read to them) or backup papers.
Yes, if you're on the ground, you won't be taking off without the stuff, but that's obvious when it can be fixed by the pilot getting out for a few minutes.
People don't screw around with plane safety. The failure mode of 'our iPads turned off' will have been considered as a prelude to their being introduced.
I'm afraid I must disagree here. The iPad is a replacement for a bunch of paper manuals and maps and charts which are the backups to the ones contained in the flight computers. So if your iPad doesn't work any more, you don't have a backup anymore and that is safety critical.
http://www.cnet.com/news/american-airlines-pilots-to-use-ipa...
EFBs have a long history in the cockpit. Charts are required to be carried by FAR, but honestly, a scheduled commercial flight genuinely needing to consult one in anger is very rare. That was the impetus to get the FAA to approve iPads for EFB use in the first place, I think, was pilots making the case that they're needed so infrequently that an iPad is fine.
Threads like this make me wish there was more general awareness of what goes on in the cockpit, because I think it would go a long way toward assuaging unnecessary fear. Aviation is one of those rare regulation success stories where pretty much everything has been thought of.
The device not working could have become an issue if something unexpected happened though.
There is a place for shiny tech, but the flight deck is not it. Paper worked, and we should go back to it.
It's wasteful to force the pilots to carry around 30lbs of paper which is out of date every few months, and which is not safety critical.
In total? That's nothing.
It'd be foolish for them to not save money when they can.
The article says pilots experienced "frequent injuries... from carrying heavy flight bags".
> An Electronic Flight Bag, which replaces more than 35 pounds of paper-based reference material and manuals that pilots often carried in their carry-on kitbag, offers numerous benefits for American and its pilots.
> ... removing the kitbag from all of our planes saves a minimum of 400,000 gallons and $1.2 million of fuel annually based on current fuel prices. Additionally, each of the more than 8,000 iPads we have deployed to date replaces more than 3,000 pages of paper previously carried by every active pilot and instructor. Altogether, 24 million pages of paper documents have been eliminated
> ... All American pilots now enjoy the benefits associated with replacing their heavy kitbags – one of the airline's biggest sources of pilot injuries – with a 1.35-pound iPad. The digital format also requires less time to update each of the six or more paper manuals found in each pilot's kitbag, as manual paper revisions take hours to complete every month, compared to the minutes it takes for electronic updates.
When it's mediated by a computer, you tend to trust it as a magic box of truth- and injecting subtle errors is going to be easier with ADS-B than on a voice channel, isn't it?
Obviously though this is a pretty big technical error on the part of Jeppeson (the app provider). It's pretty clear that it shouldn't be possible for the apps to stop working due to something done remotely. There is another provider, called ForeFlight, which I think does a better job, and I was glad to see they weren't involved.
EDIT: I just checked ForeFlight had a version update on 4/27. I doubt American is using the same software on their tablets, but then again you never know.
So not ForeFlight. Also see https://news.ycombinator.com/item?id=9457945.
Strikes me as a poor choice of words for their market.
http://www.theguardian.com/technology/2015/apr/29/apple-ipad... http://qz.com/393909/american-airlines-planes-are-grounded-b... http://money.cnn.com/2015/04/29/technology/american-airlines...
The airline will fix the bug and it won't happen again. But relying on a closed, unauditable platform to keep any sort of safety-critical data in these conditions seems absolutely unconvincing to me.
Furthermore, you have 2 iPads in the cockpit, so it could only be a problem if both fail at the same time. This seems like it'd be a more rare occurrence in the safety case.
In terms of whether open source could have helped, I doubt it very much. Stopping a bug like this (beyond extensive in-house testing) is to largely declare the platform and software bug-free (individual audits typically focus on properties like security, which are easy to target), and a full operating system (including UI) is far too large to effectively audit in that way. Certainly iOS gets far more user milage than any free alternative, which is a big advantage there.
I'd have far more faith in Apple's display system than I would the eminently auditable Gnome (this is all assuming that the FAA did not have access to the iOS source, which is unknown at this time).
http://www.dot.gov/sites/dot.dev/files/docs/vot_guidance_092...
Your time is worth $45-57 an hour, depending on if your travel is personal or business-related.
From an airline point of view, if their schedule is sufficiently flexible to accommodate the delays without flight cancellations and the delays are insufficiently long to require passengers to be compensated, the biggest costs will be additional fuel if the delays involve the aircraft being put in a holding pattern at the other end and additional time or penalty charges levied by the airports. Staffing isn't that big a deal even if they're on overtime.
I couldn't give specific numbers on the lost revenue here. It could be anywhere from a few thousand to several hundred thousand dollars. But there are people at the airline who analyze the cost of delays and they can be pretty significant - more so if this occurred at fleet launch in the early morning (though that doesn't seem to be the case).
I wonder if there is an in-between solution that would provide the benefits of an electronic display without introducing as many failure modes as a device like an iPad which is designed primarily for consumer use.
A few hundred grams? A few Kg?
http://hub.aa.com/en/nr/pressrelease/american-airlines-compl...
35 pounds, or around 16kg. That is rather heavy...
I'm thinking that they should not all carry iPads, but have one iPad and one other device from a different manufacturer running different software but with the same information, for redundancy purposes. The weight of carrying an iPad and backup device is still tiny compared to what it replaced.
Exactly my thoughts. I am surprised they didn't have any contingency plan as backup.
Do you have any Source of your claim that there was no contingency plan?
FAA regulations seems to indicate that there are plans:
"(5) Procedural means. g. Procedural Mitigations. If one or more onboard EFBs fail, resulting in loss of function or the presentation of false or hazardously misleading information, a contingency plan or process will need to be in place to provide the required information."
Page 23, http://www.faa.gov/documentlibrary/media/advisory_circular/a...
What I meant is taht they didn't have a second electronic contingency plan. Probably they had to switch to paper on those flights (otherwise the impact would have been minimal)
This sounds like a great idea in theory, but as far as I know in practice isn't ideal. Problems include less familiarity with the second system/more training time required, issues with the second system may not be discovered since it's used less, and less incentive to get the first system right in the first place.
What would perhaps be better is a backup running a previous software version, maybe.
[UPDATE] not sure for fuel, but might be true in olive prices, given these numbers:
Their website says 6,700 flights per day. Let's round it to 6000.
6,000 flights a day -> It's 2,190,000 flights a year x 100 meals per flight x 1 olive saved -> 219,000,000 olives saved.
This list http://sizes.com/food/olives.htm gives about 80-150 olives per pound (depending on the kind of olives), let's say 120 on average.
This makes 219,000,000 olives -> 1,825,000 pounds.
If they get them in bulk for like $1 or even $0.1 per pound, that's still an impressive $182,500 saved per year!
(Not sure if all flights include meals though. I used 100 meals per flight as a guesstimation could be higher/lower depending on the duration of most flights and the percs included).
None of the discussions I found online tried to calculate fuel costs, which is also a major factor in how much that one olive costs.
http://www.budgettravel.com/blog/overweight-passengers-cost-...
I don't know how accurate that is, but it passes a basic smell test for me.
An olive is about 6 grams, so the per-olive fuel consumption is about 0.0001 gallons. Jet fuel currently costs about $1.70/gallon, so that's about 0.017 cents per olive in fuel.
To save $40,000 in fuel per year by reducing olives, you'd be flying about 200 million fewer olives.
American flies about 500 million passengers per year, so $40,000 in fuel savings could be achieved with about 0.4 olives saved per passenger.
I have no idea if this actually happened, but the numbers look about right!
If an olive is 6 grams (0.013 pounds), then 100 pounds need: 7,692 olives.
For $1.7/gallon, this gives: .00022 dollars fuel cost per olive (or 77 times less than your estimation).
For 500 million passengers with one olive less, we got: 500 million less olives x 0.00022 = $110,000 in savings.
Taken from another angle, 300 passengers * 0.00022 savings per olive/passenger is: 0.066 savings per flight.
From the 6000 flights/day they have on their site, this gives: 6000 * 365 * 0.066, or a saving of $144,540, so same ballpark.
They seem to save at least $80-$100,000 per year in both fuel and olive costs by removing just one olive.
Of course while it sounds amazing to us, it involves 6000*365 flights / 500 million passengers a year.
Which means that this seemingly "large" number (when compared to say, our salary) is actually peanuts compared to their operating costs. Like, by removing one olive per passenger, they reduce their operating costs per flight by less than .000025%.
Your estimate and mine are almost the same. 0.017 cents is $0.00017 is close to $0.00022. The difference is because I did some heavy intermediate rounding, what with olive weight being highly approximate to begin with.
You're right that in relative terms, the savings is tiny. But absolute numbers count as well. If it saves $40,000/year then that means one full-time employee can spend something like 25-50% of his time working on this problem and they still come out ahead.
Ugh, yeah. 0.00017 and 0.00022 are indeed the same (for our level of accuracy), I just had not seen the "cents" and thought your 0.017 value was in $.
There are fallbacks, there are fallbacks even for the fallbacks and finally, the pilots themselves are trained in the event of total failures on all ends.
In addition, it was a software glitch. We don't know what kind of glitch it was but if it was, it doesn't matter if they were using proper-graded billion dollar worth of products, software glitches exist everywhere.
There may be a few requirements for testing and approval of electronics however.
A few airlines have switched over to digital maps for airports, since they offer some substantial advantages (less weight, more up to date, etc).
If you want to have a look at one of these apps, its on the public app store (https://itunes.apple.com/de/app/lido-iroutemanual-aeronautic...) - though I could not find a source that AA is using the LH Systems app (and if it was the source of the problem, I guess there would be several more stories about it.
edit: Source: did some work for LH Systems, but not affiliated with them.
Other countries are slowly following suit.
I'm pretty confident that pilots are required to be able to navigate with pencil and paper flight map, in case of equipment failure.
As such, I'm surprised that airlines would allow iPads to be a critical failure point.
I wish you good luck with your business, which I'm confident is highly valuable.
I'm switching to Android.
That situation is not that much better on Android either.
We already have three data points.
A couple of thousand more and our anecdotal evidence could turn into a factual one.