Incident: F-35 Software Sensors Malfunction During Formation Flight Detection.

Published Date: 2015-03-25

Postmortem Analysis
Timeline 1. The software failure incident with the F-35's sensors for the Joint Strike Fighter detecting targets incorrectly when flying in formation was reported on March 25, 2015, in Article 34903.
System 1. Sensors for the Joint Strike Fighter malfunctioned when detecting targets when the aircraft flies in formation [34903].
Responsible Organization 1. F-35 engineers working on the software package [34903]
Impacted Organization 1. Pilots of the F-35 aircraft [34903]
Software Causes 1. The software failure incident was caused by sensors for the Joint Strike Fighter malfunctioning when detecting targets in formation due to differences in angles and sensor readings from multiple aircraft [34903].
Non-software Causes 1. The angles at which the F-35 aircraft were looking at the same threat caused differences in what their sensors picked up, leading to fusion model issues [34903].
Impacts 1. The software failure incident impacted the F-35's ability to detect targets accurately when flying in formation, leading to sensor malfunctions [34903].
Preventions 1. Conducting thorough testing and validation of the software package before deployment to identify and address any sensor fusion issues [34903]. 2. Implementing a more robust and comprehensive sensor fusion algorithm that can accurately interpret data from multiple sources and angles to avoid confusion in threat detection [34903]. 3. Regularly updating and refining the software to incorporate improvements based on feedback from pilots and engineers to enhance the accuracy and reliability of threat identification [34903].
Fixes 1. Adjusting the sensitivity of the fusion algorithms for the JSF’s 2B software package with the help of Navy experts and academics from John’s Hopkins Applied Physics Laboratory [34903]. 2. Implementing concepts of operation for F-35B pilots to work around the sensor fusion problems until the software fixes are in place, such as turning off certain sensors or flying in groups of two instead of four planes [34903].
References 1. Air Force Lt. Gen. Christopher Bogdan, Program Executive Officer, F-35 [34903]

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization (a) The software failure incident related to the F-35's sensors malfunctioning when detecting targets in formation has occurred within the same organization, specifically with the F-35 aircraft. Engineers are working to fix the software package for the Joint Strike Fighter to address the issue with the sensors [34903]. (b) The incident does not mention any similar software failure happening at other organizations or with their products and services.
Phase (Design/Operation) design, unknown (a) The software failure incident in the F-35's sensors for the Joint Strike Fighter was related to the design phase. Engineers were working on adjusting the sensitivity of the fusion algorithms in the JSF's 2B software package to address the issue of multiple planes not seeing threats exactly the same way due to angles and sensor differences [34903]. (b) The article does not provide specific information about the software failure incident being related to the operation phase.
Boundary (Internal/External) within_system (a) within_system: The software failure incident related to the F-35's sensors malfunctioning when detecting targets when the aircraft flies in formation is primarily within the system. The issue arises from the fusion algorithms of the JSF's 2B software package, which are responsible for combining sensor data from multiple F-35s to identify threats accurately. The software engineers are working on adjusting the sensitivity of these fusion algorithms to ensure that groups of planes can correctly identify or discern threats [34903]. This indicates that the failure is rooted in the internal software design and functionality of the F-35's sensor fusion system. (b) outside_system: There is no explicit mention in the article of the software failure incident being caused by contributing factors originating from outside the system. The focus of the article is on the internal adjustments being made to the software to address the sensor fusion issue within the F-35 aircraft [34903]. Therefore, based on the information provided, it appears that the software failure incident is primarily within the system.
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident in the F-35's sensors for the Joint Strike Fighter was due to non-human actions. Specifically, the malfunction occurred when multiple F-35s were flying in formation, causing the sensors to have trouble distinguishing whether detected threats were isolated or multiple objects due to the angles and physics involved [34903]. (b) Human actions were involved in addressing the software failure incident. Engineers, Navy experts, and academics were working to adjust the sensitivity of the fusion algorithms in the JSF's software package to correct the issue with the sensors. Additionally, F-35B pilots were planning to use tactics and concepts of operation to work around the sensor fusion problems until the software fixes were implemented [34903].
Dimension (Hardware/Software) software (a) The software failure incident related to hardware: - The F-35's software package was experiencing issues with sensors malfunctioning when detecting targets, particularly when the aircraft flies in formation [34903]. - The sensors on the F-35s were having trouble distinguishing whether a detected threat was isolated or multiple objects due to differences in angles and sensor readings from multiple planes [34903]. - Engineers were working on adjusting the sensitivity of fusion algorithms in the software to address the issue of multiple planes not correctly identifying threats [34903]. (b) The software failure incident related to software: - The F-35's software package was identified as the source of the issue causing sensors to malfunction when detecting targets [34903]. - Engineers were specifically working on adjusting the sensitivity of fusion algorithms in the JSF's 2B software package to ensure groups of planes can correctly identify or discern threats [34903]. - The software was designed to fuse information from various sources into one common operating picture for the pilot to view, including digital maps, radar information, and sensor information [34903].
Objective (Malicious/Non-malicious) non-malicious (a) The software failure incident described in the article is non-malicious. The issue with the F-35's software package was related to the sensors malfunctioning when detecting targets in certain scenarios, particularly when multiple aircraft were flying in formation. The failure was attributed to the challenges of sensor fusion and the difficulty in accurately identifying threats when multiple planes are looking at the same target from different angles [34903]. The engineers and experts involved in addressing the issue are focused on adjusting the sensitivity of the fusion algorithms to improve the accuracy of threat identification and sharing information among the aircraft [34903]. (b) The software failure incident was not caused by any malicious intent but rather by the complexities of sensor integration and fusion in the F-35 aircraft's software system. The engineers and program officials are actively working to resolve the issue and improve the functionality of the software to ensure accurate threat detection and information sharing among the aircraft [34903].
Intent (Poor/Accidental Decisions) accidental_decisions (a) The software failure incident related to the F-35's sensors malfunctioning when detecting targets in formation does not seem to be directly linked to poor decisions. Instead, the incident appears to be a result of the complex nature of sensor fusion and the challenges in accurately identifying threats when multiple aircraft are involved. The engineers are working on adjusting the sensitivity of the fusion algorithms to address this issue [34903]. (b) The software failure incident could be attributed more to accidental decisions or unintended consequences rather than poor decisions. The challenges with sensor fusion and target identification in the F-35 aircraft seem to stem from the inherent complexities of integrating data from multiple sensors and the physics involved in how different aircraft perceive threats. The adjustments being made by the engineers indicate a response to unforeseen issues rather than poor decision-making [34903].
Capability (Incompetence/Accidental) development_incompetence, unknown (a) The software failure incident related to development incompetence is evident in the F-35's software package issue where the sensors for the Joint Strike Fighter malfunction when detecting targets in formation. This issue arises from the challenges in sensor fusion algorithms and the sensitivity adjustments needed to ensure accurate threat identification by multiple aircraft [34903]. (b) The accidental aspect of the software failure incident is not explicitly mentioned in the provided article.
Duration temporary (a) The software failure incident described in the article seems to be more of a temporary nature rather than permanent. The engineers are actively working on fixing the issue with the F-35's software package related to sensor fusion when detecting targets in formation flight. Lt. Gen. Christopher Bogdan mentioned that they are adjusting the sensitivity of the fusion algorithms to address the problem. Additionally, pilots are being advised on tactics to work around the sensor fusion problems until the software fixes are implemented [34903].
Behaviour crash, omission, value, other (a) crash: The software failure incident in the F-35's sensors for the Joint Strike Fighter can be related to a crash behavior where the system loses state and does not perform its intended functions correctly. The sensors malfunction when detecting targets when the aircraft flies in formation, leading to a situation where the fusion model cannot decide if it's one threat or more than one threat due to differences in what the airplanes are seeing [34903]. (b) omission: The software failure incident can also be associated with omission behavior where the system omits to perform its intended functions at instances. The sensors on the F-35s may have trouble distinguishing whether a detected ground threat is an isolated threat or several objects, leading to a failure in correctly identifying threats and passing that information to all airplanes [34903]. (c) timing: The timing behavior is not explicitly mentioned in the articles as a factor contributing to the software failure incident. (d) value: The software failure incident can be linked to a value behavior where the system performs its intended functions incorrectly. The sensors on the F-35s are not able to correctly identify threats and pass that information to all airplanes due to differences in what the airplanes are seeing, leading to a failure in the fusion model's decision-making process [34903]. (e) byzantine: The software failure incident does not exhibit byzantine behavior where the system behaves erroneously with inconsistent responses and interactions. (f) other: The other behavior exhibited in this software failure incident is related to the complexity of sensor fusion and the challenges in integrating data from multiple sources into a common operating picture for the pilot. The incident highlights the difficulty in ensuring that all airplanes are looking at the same threat at the same place, indicating a challenge in achieving consistent and accurate fusion of sensor information [34903].

IoT System Layer

Layer Option Rationale
Perception sensor (a) The software failure incident mentioned in the article is related to the sensor aspect of the cyber physical system. The article discusses how the sensors for the Joint Strike Fighter (F-35) malfunctioned when detecting targets when the aircraft flies in formation. The issue arose from the fact that when multiple F-35s were looking at the same threat, they didn't all see it exactly the same due to the angles and sensor differences, leading to difficulties in distinguishing whether it was a single threat or multiple objects [34903]. The engineers are working on adjusting the sensitivity of the fusion algorithms for the JSF's software package to address this sensor-related issue.
Communication unknown The software failure incident reported in Article 34903 is not related to the communication layer of the cyber physical system that failed. The article primarily discusses issues with the sensors and fusion algorithms of the F-35 aircraft's software package, which are responsible for detecting and identifying threats when the aircraft flies in formation. The failure is more focused on the sensor fusion capabilities and the algorithms used to process data from multiple sources rather than issues at the communication layer of the cyber physical system.
Application TRUE The software failure incident reported in Article 34903 is related to the application layer of the cyber physical system. The issue with the F-35's software package was specifically related to the sensors malfunctioning when detecting targets while the aircraft flies in formation. This malfunction was attributed to the fusion algorithms in the JSF's 2B software package, which were not correctly identifying threats when multiple planes were looking at the same target due to differences in sensor readings. Engineers were working on adjusting the sensitivity of the fusion algorithms to address this issue [34903].

Other Details

Category Option Rationale
Consequence non-human, theoretical_consequence (a) death: There is no mention of any deaths resulting from the software failure incident in the provided article [34903]. (b) harm: The article does not mention any physical harm caused to individuals due to the software failure incident [34903]. (c) basic: The incident did not impact people's access to food or shelter [34903]. (d) property: There is no indication that people's material goods, money, or data were impacted by the software failure incident [34903]. (e) delay: The software failure incident did not lead to any activity being postponed [34903]. (f) non-human: The software failure incident impacted the functionality of the F-35 Joint Strike Fighter's sensors, affecting the aircraft's ability to detect and discern threats when flying in formation [34903]. (g) no_consequence: The article does not mention any observed real consequences resulting from the software failure incident [34903]. (h) theoretical_consequence: The article discusses potential consequences of the software failure, such as the need for adjustments to the sensitivity of fusion algorithms and the impact on the aircraft's sensor fusion capabilities, but does not mention these consequences actually occurring [34903]. (i) other: The article does not describe any other specific consequences of the software failure incident [34903].
Domain government The software failure incident reported in Article 34903 is related to the defense industry. The incident specifically involves the F-35 Joint Strike Fighter (JSF) aircraft, which is a military aircraft developed for combat purposes. The article discusses how the sensors of the F-35 malfunctioned when detecting targets in formation, leading to the need for adjustments in the software to improve threat identification and fusion of sensor data [34903]. The F-35's software package, particularly the 2B version, is crucial for integrating sensor information, radar capabilities, and providing a comprehensive view of the battlefield for the pilot. The Marine Corps is working towards declaring the F-35B variant ready for combat by addressing software issues and implementing workarounds until the fixes are in place [34903].

Sources

Back to List