Incident: Mobile Phone Interference Causes Glitches in Cockpit Display Units

Published Date: 2019-07-19

Postmortem Analysis
Timeline 1. The software failure incident happened in November 2014 as mentioned in the article [86886].
System 1. Cockpit flight displays in Boeing 737 Next Generation and 777 airliners [86886]
Responsible Organization 1. The software failure incident was caused by a vulnerability in the cockpit display units of Boeing 737 Next Generation and 777 airliners, which could glitch due to interference from radio signals such as Wi-Fi, mobile calls, and external sources like weather radar [86886].
Impacted Organization 1. United Airlines and American Airlines [86886] 2. Ryanair [86886]
Software Causes 1. A vulnerability in the cockpit display units of Boeing 737 Next Generation and 777 airliners caused screens to glitch due to interference from radio signals, including Wi-Fi, mobile calls, and external sources like weather radar [86886]. 2. The glitch incidents reported by pilots on Boeing 737 Next Generation aircraft were attributed to a software bug in the display units, which caused all map displays and flight-management computers to go dark during critical phases of flight [86886].
Non-software Causes 1. Strong radio signals from mobile phones, Wi-Fi, and external sources like weather radar interfering with cockpit screens [86886]. 2. Vulnerable display units in Boeing 737 Next Generation and 777 airliners glitching due to radio signals [86886]. 3. Display units not being shielded against certain levels of radio interference [86886]. 4. Potential safety issue detected in 2014 leading to the directive to upgrade display units [86886]. 5. Radio frequency emissions affecting display units [86886].
Impacts 1. The software failure incident involving the faulty cockpit display units in Boeing 737 Next Generation and 777 airliners caused glitches in certain cockpit screens due to interference from radio signals like Wi-Fi, mobile calls, and external sources like weather radar [86886]. 2. The vulnerability in the display units could disrupt flight data on the aircraft's airspeed, altitude, heading, pitch/roll attitude, and other navigation information, potentially leading to a loss of flight-critical information during critical phases of flight such as approach or takeoff [86886]. 3. The impact of the software failure incident led to a directive from the US Federal Aviation Administration (FAA) requiring airline operators to replace and upgrade the cockpit flight displays before November 2019 to prevent potential safety issues that could result in loss of airplane control or controlled flight into terrain or obstacles [86886]. 4. The failure incident resulted in airlines like United Airlines, American Airlines, and Ryanair needing to replace the affected Honeywell display units in their aircraft before the deadline, with some aircraft still having the vulnerable units in use [86886]. 5. The incident raised concerns among flight crews as reports from the Aviation Safety Reporting System indicated critical incidents aboard Boeing 737 Next Generation or 777 airliners where flight information disappeared while airborne, although none of these incidents led to disasters [86886].
Preventions 1. Regular software testing and quality assurance procedures during the development and deployment of the cockpit display units could have potentially prevented the software failure incident [86886]. 2. Implementing stricter regulations and standards for the manufacturing and testing of critical aviation software components, such as the cockpit display units, could have helped prevent the vulnerability that led to the glitch [86886]. 3. Timely software updates and patches to address any identified software bugs or vulnerabilities in the cockpit display units could have mitigated the risk of interference from radio signals [86886].
Fixes 1. Upgrading the cockpit flight displays by replacing the suspect display units with a newer model and installing new display unit software [86886]. 2. Implementing the directive issued by the US Federal Aviation Administration (FAA) to upgrade all display units in Boeing 737 Next Generation and 777 cockpits [86886]. 3. Ensuring that airline operators comply with the airworthiness standards and complete the mandatory upgrades within the specified time frame [86886]. 4. Conducting inspections on all affected aircraft and replacing any faulty display units to ensure safety and compliance with regulations [86886].
References 1. US Federal Aviation Administration (FAA) [86886] 2. Honeywell Aerospace [86886] 3. United Airlines [86886] 4. American Airlines [86886] 5. Ryanair [86886] 6. Delta Airlines [86886] 7. Southwest Airlines [86886] 8. Boeing [86886] 9. NASA Aviation Safety Reporting System [86886] 10. Embry-Riddle Aeronautical University [86886]

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization, multiple_organization (a) The software failure incident related to the glitch in cockpit display units affecting Boeing 737 Next Generation and 777 airliners has happened again at Honeywell Aerospace. The article mentions that Honeywell Aerospace, the manufacturer of the faulty screens, stated that up to 70 planes may still have the affected display units, even though they mentioned that there is no evidence that the airplanes are operational and many units could be on retired aircraft or simulators [86886]. (b) The software failure incident related to the glitch in cockpit display units has also happened at other organizations. The article mentions that United Airlines and American Airlines both have outstanding screens to replace, with 17 and 14 aircraft respectively needing updates before the November deadline. Additionally, Ryanair reportedly told the FAA in 2014 that its fleet contained 707 of the affected Honeywell units, arguing that the requirement to replace all of them was imposing a high financial burden on operators [86886].
Phase (Design/Operation) design, operation (a) The software failure incident related to the design phase can be seen in the article where a vulnerability was discovered in 2014 that causes some screens in Boeing 737 Next Generation and 777 airliners to glitch with sufficient interference from radio signals. This glitch was attributed to radio signals from mobiles, Wi-Fi, and external sources like weather radar interfering with certain cockpit screens, indicating a design flaw in the display units [86886]. (b) The software failure incident related to the operation phase is evident in the article where multiple critical incidents were reported aboard Boeing 737 Next Generation or 777 airliners where flight information disappeared while airborne. For example, a 737 out of Costa Rica experienced all map displays and flight-management computers going dark during a critical phase of flight, and a 737-700 reported flight information flashing on and off displays before the primary display unit went completely black. These incidents highlight failures during the operation of the system, causing concern for flight crews [86886].
Boundary (Internal/External) within_system, outside_system (a) within_system: The software failure incident related to the glitch in cockpit display units on Boeing 737 Next Generation and 777 airliners was primarily caused by radio signals such as from mobile phones, Wi-Fi, and external sources like weather radar interfering with the display units [86886]. The vulnerability in the display units caused screens to glitch with sufficient interference from these radio signals, leading to critical incidents where flight information disappeared while airborne [86886]. The affected display units were supposed to be shielded against certain levels of radio interference, but the issue was traced back to a software bug in the display units themselves [86886]. (b) outside_system: The contributing factors that originated from outside the system in this software failure incident include the radio signals emitted by mobile phones, Wi-Fi, and external sources like weather radar that interfered with the cockpit display units [86886]. The interference from these external radio signals disrupted the proper functioning of the display units, leading to potential safety risks during critical phases of flight such as takeoff and landing [86886].
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident occurring due to non-human actions: The software failure incident in the articles was primarily due to radio signals, such as those from mobile phones, Wi-Fi, and external sources like weather radar, interfering with certain cockpit flight displays [86886]. The vulnerability in the cockpit screens of Boeing 737 Next Generation and 777 airliners was caused by radio signals, not directly by human actions. The glitch in the screens was attributed to radio interference, leading to issues with displaying flight data like airspeed, altitude, and navigation information. (b) The software failure incident occurring due to human actions: While the software failure incident itself was not directly caused by human actions, there were aspects related to human actions in the response to the incident. For example, airline operators and display manufacturer Honeywell Aerospace argued against the ruling to replace the display units, claiming that radio signals were unlikely to cause problems during flight [86886]. Additionally, there were delays in replacing the faulty display units by some airlines, which could be considered as human actions contributing to the persistence of the software failure incident.
Dimension (Hardware/Software) hardware, software (a) The software failure incident in the articles is primarily related to hardware issues. The incident involves a vulnerability in cockpit display units in Boeing 737 Next Generation and 777 airliners that causes screens to glitch with interference from radio signals, such as those from Wi-Fi, mobile calls, and external sources like weather radar [86886]. The directive to replace the potentially vulnerable display units was issued by the US Federal Aviation Administration (FAA) to prevent loss of flight-critical information displayed to the flightcrew during critical phases of flight, which could result in loss of airplane control or controlled flight into terrain [86886]. (b) The software failure incident also mentions a case where all six display units in a 737 cockpit went blank, which was traced to a software bug that has been fixed [86886]. Additionally, there were reports of flight information disappearing while airborne on Boeing 737 Next Generation or 777 airliners, which could be attributed to software glitches [86886].
Objective (Malicious/Non-malicious) non-malicious (a) The software failure incident related to the cockpit display units in Boeing 737 Next Generation and 777 airliners was non-malicious. The failure was due to vulnerabilities in the display units that could be exploited by radio signals from sources like Wi-Fi, mobile calls, and weather radar, causing glitches in the cockpit screens [86886]. The issue was identified by officials and the US Federal Aviation Administration (FAA) issued a directive to replace the vulnerable units to prevent potential loss of flight-critical information displayed to the flight crew during critical phases of flight, such as approach or takeoff. The directive aimed to ensure the safety of the aircraft and prevent incidents like loss of airplane control or controlled flight into terrain or obstacles [86886]. The software failure incident was a result of technical issues and vulnerabilities in the display units rather than any malicious intent to harm the system.
Intent (Poor/Accidental Decisions) poor_decisions, accidental_decisions (a) The intent of the software failure incident related to poor decisions can be seen in the article. The vulnerability in the cockpit display units of Boeing 737 Next Generation and 777 airliners was discovered in 2014, causing screens to glitch with interference from radio signals such as Wi-Fi and mobile calls [86886]. Despite the discovery of this vulnerability, some airlines like United Airlines and American Airlines still have outstanding screens to replace, with a deadline set for November 2019. Manufacturer Honeywell Aerospace initially argued against the ruling to replace the display units, claiming that radio signals were unlikely to cause problems during flight. However, in-service planes failed tests undertaken by US authorities, leading to the ruling standing with a five-year grace period for upgrades [86886]. This delay in addressing the issue and the resistance to the directive can be attributed to poor decisions made by the airline operators and the display manufacturer. (b) The software failure incident can also be linked to accidental decisions or unintended consequences. The article mentions that Honeywell Aerospace spokesperson Nina Krauss stated that the issue of all six display units in a 737 cockpit going blank was traced to a software bug, which has since been fixed [86886]. This incident highlights how unintended software bugs or faults can lead to critical failures in the cockpit display units, potentially endangering flight safety. Additionally, there were reports of critical incidents aboard Boeing 737 Next Generation or 777 airliners where flight information disappeared while airborne, causing concern for flight crews [86886]. These accidental glitches and failures in the display units could have led to disastrous outcomes if they occurred under less favorable circumstances, emphasizing the importance of addressing software defects promptly to ensure safe flight operations.
Capability (Incompetence/Accidental) accidental (a) The software failure incident in the articles is not related to development incompetence. The failure was not due to lack of professional competence by humans or the development organization. Instead, the incident was primarily caused by a vulnerability in the display units installed in Boeing 737 Next Generation and 777 airliners, which could be disrupted by radio signals from mobile phones, Wi-Fi, and external sources like weather radar [86886]. (b) The software failure incident can be categorized as accidental. The glitch in the cockpit flight displays was caused by radio signals, such as those from mobile phones, Wi-Fi, and external sources like weather radar, interfering with the display units. This interference was not intentional but accidental, leading to critical incidents where flight information disappeared while airborne, causing concern for flight crews [86886].
Duration temporary (a) The software failure incident in this case was temporary. The article mentions incidents where flight information disappeared, displays went blank, or key flight data flickered off during flight, causing concern for the flight crews. These incidents were due to glitches in the cockpit flight displays, potentially caused by radio signals from mobile phones, Wi-Fi, and other sources interfering with the display units [86886]. (b) The software failure incident was not permanent as the glitches and issues with the cockpit flight displays were temporary and did not lead to disaster in the reported incidents. The article also mentions that the display units are backed up by redundancies, indicating that the failures were not permanent but rather temporary glitches that were rectified [86886].
Behaviour crash (a) crash: The software failure incident in the articles can be categorized as a crash. The incident involved cockpit flight displays in Boeing 737 Next Generation and 777 airliners glitching due to interference from radio signals, such as from mobile phones, Wi-Fi, and external sources like weather radar. This interference caused the screens to malfunction and lose critical flight information, potentially leading to a loss of airplane control or controlled flight into terrain [86886]. (b) omission: There is no specific mention of the software failure incident being related to the system omitting to perform its intended functions at an instance(s) in the articles. (c) timing: The software failure incident is not related to the system performing its intended functions correctly, but too late or too early in the articles. (d) value: The software failure incident is not related to the system performing its intended functions incorrectly in the articles. (e) byzantine: The software failure incident is not related to the system behaving erroneously with inconsistent responses and interactions in the articles. (f) other: The software failure incident involved the cockpit flight displays in Boeing 737 Next Generation and 777 airliners glitching due to interference from radio signals, which can be categorized as a crash.

IoT System Layer

Layer Option Rationale
Perception sensor, embedded_software (a) sensor: The software failure incident was related to the sensor layer of the cyber physical system. The vulnerability in the cockpit display units of Boeing 737 Next Generation and 777 airliners was caused by radio signals from sources like Wi-Fi, mobile calls, and external sources like weather radar interfering with certain cockpit screens [86886]. (b) actuator: There is no specific mention of a failure related to the actuator layer in the provided article. (c) processing_unit: The failure was not directly attributed to a processing unit error but rather to the interference caused by radio signals affecting the cockpit display units [86886]. (d) network_communication: The software failure incident was not primarily due to network communication errors but rather interference from radio signals affecting the cockpit display units [86886]. (e) embedded_software: The incident did involve a software bug in the cockpit display units of Boeing 737 Next Generation and 777 airliners. In one case, all six display units in a 737 cockpit went blank due to a software bug, which was subsequently fixed [86886].
Communication link_level The software failure incident described in the articles is related to the communication layer of the cyber physical system that failed at the link_level. The failure was due to contributing factors introduced by the physical layer, specifically radio signals such as those from mobile phones, Wi-Fi, and external sources like weather radar interfering with certain cockpit screens in Boeing 737 Next Generation and 777 airliners [86886]. The vulnerability in the display units caused glitches when exposed to strong radio signals, leading to disruptions in providing flight data to the cockpit screens. The issue required the replacement of the suspect display units with newer models and the installation of new display unit software to address the interference problem [86886].
Application FALSE The software failure incident described in the articles is not related to the application layer of the cyber physical system. The failure was attributed to a vulnerability in cockpit display units caused by radio signals such as those from mobile phones, Wi-Fi, and external sources like weather radar, which interfered with certain cockpit screens in Boeing 737 Next Generation and 777 airliners [86886].

Other Details

Category Option Rationale
Consequence no_consequence (a) death: People lost their lives due to the software failure - There is no mention of any deaths resulting from the software failure incident reported in the articles. [86886]
Domain transportation The software failure incident reported in the articles is related to the transportation industry. The incident involved cockpit flight displays in Boeing 737 Next Generation and 777 airliners being vulnerable to interference from radio signals emitted by mobile phones, Wi-Fi, and external sources like weather radar [Article 86886]. The affected display units provide critical flight data such as airspeed, altitude, heading, and navigation information, which are essential for safe operation during flights. The Federal Aviation Administration (FAA) issued a directive in 2014 for airline operators to replace and upgrade these cockpit flight displays to prevent potential loss of flight-critical information and ensure airworthiness standards [Article 86886]. The directive impacted various airlines, including United Airlines, American Airlines, Delta Airlines, Southwest Airlines, and Ryanair, all of which had to address the issue to comply with safety regulations [Article 86886].

Sources

Back to List