Redundant switch failure causes degraded controls on Pilatus PC-24

Modern aircraft generally are designed with many redundancies built in. Testing and managing what happens when those systems both fail, however, does not always get sufficient attention. And in the case of the Pilatus PC-24 a dual failure on a data communications bus led to some interesting results in flight.

The problems were first realized in flight when an on-board ethernet switch failed. The incident is described by EASA as a “dual Ethernet communication channel failure on a dual-channel data concentration and processing unit.” This prevented the various onboard systems from properly relaying data to each other and to the pilot. This partial failure state triggered a number of “electronic circuit breakers” affecting multiple additional on-board systems.

Passenger oxygen masks deployed and the autopilot entered an emergency descent mode. Cabin environmental controls were degraded and the crew received various alert messages. Flaps, fuel indicators and deicing systems were “significantly degraded.”

This all contributes to what EASA descries as reduced safety margins and “increased pilot workload” to recover and determine what is actually broken.

And to fix it, PC-24 operators must do what everyone else operating highly digital-dependent systems does on a regular basis: Apply a software upgrade. Version 7.3 of the control software for the Utility Management System addresses the issues and prevents the degraded state should the controller fail.

EASA issued an Airworthiness Directive to address the issues. It takes effect on 1 October and all aircraft with the older switch software build must be updated by the end of the month. Aircraft built since March 2020 already have the updated software installed from the factory.