Boeing To Make Key Change in 737 MAX Cockpit Software (wsj.com) 211
Boeing is making an extensive change to the flight-control system in the 737 MAX aircraft implicated in October's Lion Air crash in Indonesia, going beyond what many industry officials familiar with the discussions had anticipated. From a report: The change was in the works before a second plane of the same make crashed in Africa last weekend -- and comes as world-wide unease about the 737 MAX's safety grows. The change would mark a major shift from how Boeing originally designed a stall-prevention feature in the aircraft, which were first delivered to airlines in 2017. U.S. aviation regulators are expected to mandate the change by the end of April.
Boeing publicly released details about the planned 737 MAX software update late Monday [Editor's note: the link may be paywalled; alternative source]. A company spokesman confirmed the update would use multiple sensors, or data feeds, in MAX's stall-prevention system -- instead of the current reliance on a single sensor. The change was prompted by preliminary results from the Indonesian crash investigation indicating that erroneous data from a single sensor, which measures the angle of the plane's nose, caused the stall-prevention system to misfire. Then, a series of events put the aircraft into a dangerous dive.
Boeing publicly released details about the planned 737 MAX software update late Monday [Editor's note: the link may be paywalled; alternative source]. A company spokesman confirmed the update would use multiple sensors, or data feeds, in MAX's stall-prevention system -- instead of the current reliance on a single sensor. The change was prompted by preliminary results from the Indonesian crash investigation indicating that erroneous data from a single sensor, which measures the angle of the plane's nose, caused the stall-prevention system to misfire. Then, a series of events put the aircraft into a dangerous dive.
I guess the incredibly obvious question is... (Score:5, Interesting)
Why the hell wasn't this the case before?
Aren't flight control systems supposed to be triple-redundant anyway? Everything I've read about them says they are; three systems and if there is incorrect data it uses the two that agree.
Re:I guess the incredibly obvious question is... (Score:5, Interesting)
I assume they're talking about the sensor behind the pitot hole here. Making that the only sensor, and non-redundant, is particularly questionable. It's well known that pitot holes are very easily thrown off: an insect building a nest inside it (or ice forming, or etc) will throw off the sensor enough to crash a plane, if it's all you rely on.
Re:I guess the incredibly obvious question is... (Score:5, Insightful)
I assume they're talking about the sensor behind the pitot hole here. Making that the only sensor, and non-redundant, is particularly questionable. It's well known that pitot holes are very easily thrown off: an insect building a nest inside it (or ice forming, or etc) will throw off the sensor enough to crash a plane, if it's all you rely on.
I would assume you're correct here, but it still begs the question as to why this sensor was non-redundant, and how that SPOF design ultimately got approved.
Re: (Score:3)
Why the hell wasn't this the case before?
...
I assume they're talking about the sensor behind the pitot hole here. Making that the only sensor, and non-redundant, is particularly questionable.
I would assume you're correct here, but it still begs the question as to why this sensor was non-redundant, and how that SPOF design ultimately got approved.
I am baffled as to why, if the problem had been identified, the planes weren't grounded until the software fix was implemented.
Alternate source:
https://www.morningstar.com/ne... [morningstar.com]
Re: (Score:2)
Re: (Score:2)
They changed the system acronym (much has been made of this), but the response to 'runaway trim' remained throwing the same two switches. That's been on the troubleshooting checklist of Boeing airplanes forever.
The second crash was reportedly trailing fire before impact. Eyewitness, so take it with a huge grain of salt.
Also the copilot is reported to have 200 hours? 200 hours total and flying a multi engine commercial jet? I think it has to be 200 hours in the type.
Re:I guess the incredibly obvious question is... (Score:5, Interesting)
My lay person's understanding...
In order to increase fuel efficiency on the 737 MAX, the engine fan diameter was increased. These "underwing" engines would have been too close to the ground if mounted as on other 737 models. Thus, the engineers moved the engines forward and upward to achieve necessary ground clearance. This, along with some other changes, moved the force of thrust forward which made the plane more prone to lift its nose too high and stall. To guard against this, Boeing introduced the Maneuvering Characteristics Augmentation System (MCAS) which activates automatically when the autopilot is off in some conditions which include when the angle of attack (AOA) is too high. The MCAS system, when needed, attempts to prevent a stall by adjusting the horizontal stabilizer trim upward and will do this over, I believe, about 10 seconds or until the pilot overrides it or the angle of attack is within limits. If the pilot activates the trim control switch on the yoke, MCAS will be disabled -- but, five seconds after the switch is released, MCAS will reengage if the conditions call for it (esp. AOA). When MCAS is altering the trim, the manual trim controls on each side of the center "console" will be spinning away and, if a pilot looks down, they will see that motion as there is a white stripe extending outward from the center in order to make the movement obvious.
The best speculation I've heard about the Lion Air crash was that there was a problem with one of the AOA sensors. There are two such sensors - one on both side of the 737 Max.
As in most crashes, due to the redundancy of systems and procedures, it's rarely one thing that causes a crash but rather a cascade of events.
There had been problems with at least one of the AOAs on previous flights but maintenance attempts appear not to have solved the problem. So, first there was a failure of maintenance, but of course AOA sensors will fail from time to time, so one can't blame the crash on that failure.
I've not heard how MCAS handled conflicting AOA sensor readings but I suspect this is one of the big areas of change that they will push in the April "patch". But, it's likely that the failing AOA caused the MCAS to activate when it shouldn't have and push the nose down by adjusting the trim - but this actually pushed the plane's nose down too far. When the pilots tried to correct, they ended up disabling MCAS (although perhaps not explicitly aware that they were doing so) only to have it start undoing what they had accomplished five seconds after they released the trim control on the yolk - and this was a vicious loop.
Had the pilot recognized what was happening, they simply would have ran the "runaway trim" procedure (which would have disabled MCAS and some other automatic trim controls completely via a switch on the center "console") and flown the plane manually with no problems. Unfortunately, the pilots likely didn't figure out what was causing the problem and failed to execute the necessary procedure. So, that was a pilot error (and, that's probably what will be determined to be the main problem here, with contributing factors).
There is much debate on why the Lion Air pilots may have failed to recognize what was going on. Many pilots and their union claim that they were not told about the existence of MCAS. Boeing hasn't been talking a lot, but they seem to assert that there was no need to train the pilots on MCAS beyond what the manuals/training did as it was a classic "runaway trim" scenario and the training was sufficient to cause the pilots to detect that case and initiate the proper procedure. Boeing did, however, issue documentation updates to operators worldwide soon after the Lion Air crash.
After Boeing issued the documentation updates, every 737 MAX pilot should have been fully aware of MCAS and what to do if was doing the wrong thing. This, coupled with the witness reports that the Ethiopian Airline 737 MAX that crashed was spewing smoke and fire from the back of the plane a
Re: (Score:3)
The best speculation I've heard about the Lion Air crash was that there was a problem with one of the AOA sensors. There are two such sensors - one on both side of the 737 Max.
One problem is that, if I understand correctly, not all of the 737 aircraft have even so much as an indicator light when the two AOA sensors disagree. At least one airliner (Southwest) insisted on an explicit AOA indicator so you can see both AOA sensors' data and see how much they disagree. But if you don't have that and don't have the indicator light, all you know is that the aircraft keeps trimming the nose down every few seconds. One might still arguably call it pilot error to not recognize the sympt
Re: (Score:2)
Boeing added MCAS mechanism to helpfully(Clippy) push the nose down when a sensor detected risk of stalling. The mechanism was using single sensor (per side) , was not obvious to disable and kept interacting with the pilot. And marketing claimed costly retraining wasn't needed? Sounds like a major fuckup.
This article from last year suggests the pilots were already pretty pissed off about the last incident: https://christinenegroni.com/7... [christinenegroni.com]
Re: (Score:3)
So, that was a pilot error (and, that's probably what will be determined to be the main problem here, with contributing factors).
As someone who's a technical trainer (in a different transportation field, but still mission critical), this sounds to me like a design failure compounded by insufficient training, rather than pilot error. Training is incredibly important, but it also shouldn't be making up for poor design choices.
Re: (Score:2)
Boeing's contention seems to be "this looked like runaway trim", detect that and follow the "runaway trim procedure". If that's bears out, then I think it's primarily pilot error with, likely, significant contributing factors of design and/or training deficiencies.
Obviously the design could have been "better" (else, why update the software - except for political reasons), but that doesn't mean it's necessarily a "failure".
Re: (Score:2)
I'll throw in a side issue here. The changes made to the 737 within a gnat's testicle of having to declare the 737 MAX a new model of plane. Using the old model number as helped. As such, they haven't had to do full testing to have it declared "flight ready" but rather use grandfathered flight approvals and just minor testing.
The 737 MAX should have been a new model.
As I said before, it would have new testing. Add to this new documentation, and new training for pilots. It simply would not have been possible
Re: (Score:2)
A plane that can turn an expert pilot into an "idiot" is not one I wish to fly in.
Re: (Score:2)
On my keyboard, you press shift and 4 together.
Re: (Score:3, Informative)
Re: (Score:2)
The sensor in question (in the story, not the pitot) is an angle-of-attack sensor and has only to do with the orientation of the wings to the wind flowing over them (or not, in a stall).
Pitot tubes are commonly used as angle angle-of-attack sensors. They measure air pressure very finely, and that pressure changes with angle of attack.
Re: (Score:2)
I was under the impression that each of the 3 redundant systems had their own set of sensors. Sounds like this particular system is not redundant and that they are now going to derive data from other sensors to compensate. I would feel a lot better if MCAS or any other system that takes control of flight also be triple redundant.
Re: (Score:2, Interesting)
This is what happens when you stop expecting your companies to compete on the free market and instead protect them with a combination of defacto and real terms state aid, such as trying to destroy competition such as Bombardier with illegal trade acts.
As soon as you let your companies stop competing and instead give them a position of immunity, determine them too big to fail, and no longer deemed in need of competing on the free market, then they'll get lazy, they'll get incompetent, and shit like this will
Re: (Score:2)
Unh... Dorsai reference? All my mental banks pull up for "alternate law" is the Chantry Guild. But I'd really like to understand why you think that relates.
Re:The problem is normal and alternate control law (Score:5, Informative)
A description of alternate law as it applies to aviation can be found here [skybrary.aero] although this focuses on Airbus.
Re: (Score:2)
Thank you. Someone please mod parent up as informative.
Re: (Score:2)
Re: (Score:2)
I believe there are two, not one, that are inputs to MCAS
Re: (Score:2)
Unfortunately, you need three to have real redundancy since otherwise the system can't decide which one is wrong.
Re:I guess the incredibly obvious question is... (Score:4, Informative)
Yes, this is absolutely bananas. Even the accelerator pedal position sensor on cars with throttle-by-wire is a pair of pots, not just one. If one sweeps smoothly and the other doesn't, the PCM throws a code and only listens to the smooth input.
Re:I guess the incredibly obvious question is... (Score:4)
The question here is why is the computer listening to a sensor instead of the pilot. A plane can be flown just fine without any instrumentation other than the front window. Why does that sensor get to override the pilot?
Re: (Score:3)
The question here is why is the computer listening to a sensor instead of the pilot. A plane can be flown just fine without any instrumentation other than the front window. Why does that sensor get to override the pilot?
A car can be driven just fine through no information but the window view and the butt dyno, but the [mandatory] ESP system will still start fucking with your brakes if the accelerometer says that you're yawing in a way that isn't called for by the steering angle sensor. The answer to the question of why is the same in both cases, assistive technologies. When everything is working correctly, the vehicle is much better than you are at figuring out what is happening. Normally, as has been pointed out several t
Re: (Score:2, Informative)
A car can not at this point ever be described as being able to understand whats going on. And it certainly can not exceed the ability of even the average asshole
It's not better than a human overall at either, but it's better at detecting wheelslip and doing something about it, whether it's ABS, ESP, or EDL. Traction control is usually pretty crap, unless it's something modern like crawl control. Old ABS was also pretty crap, but still better than most drivers anyway.
Re: (Score:3)
Only a tiny general aviation aircraft can be flown that way. And even then it can only be flown that way at low altitude and full visibility because the vestibular system doesn't work correctly during flight. An airliner must be flown using instruments.
https://en.m.wikipedia.org/wik... [wikipedia.org]
And don't delude yourselves that you are special and would be able to feel your position correctly.
Re: (Score:2)
Well, airliners should be flown with instruments. But sometimes you can't, such as what happened with the Gimli Glider (a 767 that ran out of fuel at altitude). The only instruments they had left after the fuel ran out were the pneumatic airspeed indicators, and the barometric altimeter, both of which are purely mechanical devices. The pilot landed it safely, and the aircraft spent another 30 years in revenue service after being refueled (and minor repairs due to a collapsed nose wheel).
Re: (Score:2)
There had to be more backup instruments powered by the ram air turbine or the batteries than just two. At the very least a compass, an artificial horizon and a bank and turn indicator.
Re: (Score:3)
There are two AOA sensors on the 737 MAX - one on each side. The erroneous one may give a rational, yet wrong, signal. However, I suspect that the Boeing "patch" will add cross checking and perhaps more explicit alerts to the pilots when something seems "off".
Re:I guess the incredibly obvious question is... (Score:5, Interesting)
Why the hell wasn't this the case before?
Aren't flight control systems supposed to be triple-redundant anyway? Everything I've read about them says they are; three systems and if there is incorrect data it uses the two that agree.
Well.. I believe the way the system works allows the control inputs of the pilots are able to overcome anything the system does. It's basically like an autopilot, where the pilot can override the system by applying pressure to the controls. This system is designed to apply backpressure as the aircraft approaches a stall, making it harder for the pilot to continue to increase the angle of attack and hopefully avoiding the stall. So you can still stall the aircraft, just pull harder and keep increasing the AOA...
The problem though, is that pilots are conditioned to change the trim to deal with unusual pressures for the desired pitch angle. So if the system believes the sensor and it's saying "STALL" but you are actually not, the system applies pressure to lower the nose, which the pilots will be conditioned to trim out. IF the stall doesn't go away, the system keeps the pressure there and unless the pilots realize what's going on they will keep trimming nose up. Eventually, the process ends up with an aircraft that's severely out of pitch trim which will be very confusing to the pilots, with really high control pressures required to do anything to the pitch. Thus "control problems" seems to describe exactly what I imagine was going on. It was a vicious cycle that makes the aircraft really hard to control.
So, I understand the engineering and using one AOA sensor. Kind of makes sense... Hey, the pilots can just override this anyway, we are stopping them from actually stalling the aircraft, just making it harder to do. We've don't this before in fighter aircraft and other fly by wire systems w/o any problems. But I think there wasn't enough thought given to what happens when that sensor fails and if they can implement some cross checks between airspeed, rate of climb, rate of turn, they might be able to more gracefully fail the system and disable it, or at least not get into the vicious cycle that leads to a pitch trim issue.
Re:I guess the incredibly obvious question is... (Score:4, Interesting)
The MCAS spins the same trim knobs that the pilot spins. So the pilot can trim the nose back and after MCAS spins it down. They might fight each other, but ultimately they are both adjusting (and potentially undoing) the same thing. I'm sure it's initially confusing to pilots for sure, especially because older planes would cancel the automatic trims when the stick was pulled on, but apparently this is not the case with MCAS. If it turns out the MCAS contributed to the Indonesian crash, then it was a matter of training. But Boeing screwed up the design.
Re: (Score:3)
I think that pulling the stick back disables it - but only temporarily. It waits till the pilots think the problem has gone away, then starts shoving the nose down again.
Why anyone could think this is better is beyond me.
Re: (Score:2)
Technically this system is supposed to assist the pilots in avoiding or recovering from a stall, compensating for poorer aerodynamics on the MAX. It might have gotten approved without the normal redundancies because it only assists the pilot. I know a few other industries where that excuse flies....
Re: (Score:2)
Was there a parked fire truck nearby?
Re:I guess the incredibly obvious question is... (Score:5, Interesting)
This isn't the first time faulty airspeed readings led to a flight computer [wikipedia.org] has led to a crash. It isn't even the second time [wikipedia.org]. In all previous cases, the plane was flyable. It was the confusion as the pilots tried to diagnose the problem based on the bizarre behavior of the plane and the flight control software and alarms which doomed the flights. It requires a deep and thorough understanding of when different flight protection modes in the software are triggered and kick in, to work backwards from the behavior you're seeing, to what problem(s) could be triggering those modes. If you've debugged software, you've encountered this. Unlike natural laws like physics, software can be designed arbitrarily. So your intuitive feel for how things should work becomes useless for tracking down the problem. You're totally dependent on how thoroughly you understand the software's arbitrary design.
Bear in mind that the stall warning is pretty much a "you're gonna die if you ignore me" warning. So it takes quite a bit of convincing before pilots will decide it's the warning that's faulty, not something else that they're doing wrong. That may be the cause of the reluctance of pilots to simply shut it off and fly the plane "by the seat of their pants" based on how the throttle settings, altitude, and attitude. So while theoretically the stall warning triggering incorrectly is a recoverable problem, it may take pilots a long time to diagnose and clear up the problem. Long enough for the plane to crash.
seems like the logic here is flawed. (Score:3)
Okay lets suppose that some or all of the stall sensors are malfunctioning. There's another sensor that the computer can look at and that's the altitude. If the ALTITUDE is rapidly falling of course the plane might think, see I was right about this stall! But there's one more thing. Namely if the pilots pulled the stick back and the altitude stops falling the plane should now have enough information to figure out that pushing the stick forward is not the right thing to do.
So it seems like the plane shou
Re:seems like the logic here is flawed. (Score:5, Interesting)
No, you're trying to grossly oversimplify the problem, and it's causing you to say things that are silly.
Having worked as a vendor to the avionics group at Boeing, and having had a student who wrote test code for the 777, I can tell you that the testing / verification process for their software is mind boggling. They've had decades to fine tune their processes for creating reliable computer software. Believe me, you sound idiotic second guessing them, and it doesn't sound like you're a pilot either...
The one thing I will agree with you about is that the system should trust the crew. However, I must say that some of my airline captain buddies would strongly disagree with that. Just look at Air France Flight 447 as a perfect example of why trusting the crew can go wrong. However, I still lean towards this... if you don't trust the crew then it's like the old joke about the perfect crew:
The ideal flight crew is a pilot and a dog.
The pilot is there to feed the dog, and the dog is there to bite the pilot if he touches anything.
Seriously, if the automation is so complicated and opaque that the crew can't tell what it's doing and why... that's a problem. The move towards more automation seems to be to make up for an inexperienced crew... I think more training / sim time is the right solution, not more automation. Still, both Airbus and Boeing seem to think more automation is the right way to go.
I'll be interested to hear what they learn from the FDR...
Re: (Score:3)
Re:seems like the logic here is flawed. (Score:4, Insightful)
I can tell you that the testing / verification process for their software is mind boggling. They've had decades to fine tune their processes for creating reliable computer software.
Haven't we had ample evidence by now that it's all too easy to make computer software that very reliably and very accurately does exactly the wrong thing?
Re: (Score:2)
I would say that the evidence is that software is incredibly difficult to get 100% right, so that it will do the correct thing under all circumstances. Companies like Boeing are incredibly good at the job, and yet even they get stuff wrong.
What I'd like the average slashdot reader to understand is that it's bogus to think that there are simple answers to a lot of the issues. An incredible amount of thought goes into the process. I worked on avionics software and I can tell you that the average software engi
Re: (Score:2)
No i'm not oversimplifying or at at least you have not shown how. If the plane is dropping the plan knows this. If every time the pilot pulls back on the stick and overrides the automatic dive the plane goes up, the plane knows that too. So the plane has the info it needs to make a better decision. Show me how I'm wrong.
Re: (Score:2)
The angle of attack is NOT the orientation of the plane. It is the orientation of the plane measured relative to the air flow direction. Without knowing the airflow you can not estimate it. That is why there is a sensor outside (basically a weather wane with instrumentation to measure its orientation with respect to the plane's axis).
Again why they rely on a single sensor, why they did not make this critical sensor re
Re: (Score:2)
The opposite happened on XL Airways Flight 888, an acceptance flight for an Air New Zealand Airbus A320 going back to ANZ after a lease to XL Airways Germany. The Airbus A320's computers noticed the conflicting readings from the sensors and put the pitch trim into manual mode. The pilots didn't notice the warning on a screen and were relying on the flight computers to prevent the plane from stalling. https://www.youtube.com/watch?... [youtube.com]
Re: (Score:2)
Naa, that is the old thinking. The new thinking is that it must be as cheap as possible, profits must be maximized and if it goes wrong, blame the young end inexperienced engineers that did not have the guts to give management a clear "no". Also, do not tell the pilots about the crap engineering you put in there, they may refuse to fly that thing otherwise.
Re: I guess the incredibly obvious question is.. (Score:2, Informative)
There is an option to disable the system. It's a new system and there was not a lot of training about it though.
Re: I guess the incredibly obvious question is.. (Score:5, Funny)
It's a button in the aft toilet under a locked flap with "beware of the leopard" written on it.
Re: I guess the incredibly obvious question is... (Score:4, Informative)
Re: (Score:2)
Re: (Score:2)
Re: (Score:3)
I think you're mixing up fly-by-wire with the previous technology. Fly by wire is what we have: the pilot tells the computer what they want to happen (through the controls) and the computer tells the control surfaces what to do. I have to say that I don't like the idea of a FBW system without a manual reversion mode. Software is just too difficult to get right. The manufacturers are worrying about a bunch of stuff, safety is one of them, but economics is what sells airplanes so there are tradeoffs Airbus an
Re: (Score:2)
Without fly by wire this happens:
https://en.m.wikipedia.org/wik... [wikipedia.org]
Re: (Score:2)
A direct mechanical linkage (mostly bowden cables) between the stick and the rudders runs over the whole length of the airplane and through several corners. It has to be maintained carefully lest it snaps. It is also not very precise and lenghtens with use. This is not the only crash where a bowden cable snapped. I can recall several examples, like this one:
https://en.m.wikipedia.org/wik... [wikipedia.org]
Decoupling the steering physically from the rudders also makes envelope protection possible.
editor fail (Score:2)
msmash: that alternative link has even less useful information than the truncated wsj article.
Re: (Score:2, Informative)
Jesus you suck at being an editor, msmash
https://boeing.mediaroom.com/n... [mediaroom.com]
Obvious (Score:5, Funny)
if ( goingToCrash ) {
dontCrash();
}
Re: (Score:3)
Error 404: variable "goingToCrash" not found. Application will now crash.
Next one will crash due to stall (Score:4, Interesting)
Re: (Score:3)
Probably. The whole thing is a mess, these engines have no business being on that plane. Add an apparently completely incompetent belief that software can fix anything and you get a lot of dead people, all for profit optimization.
Additional sources (Score:5, Informative)
Since the alternative source link in the summary appears to link to an article about stock prices, here's some alternative alternative links that actually contain more relevant information:
- Boeing press release [mediaroom.com]
- Gizmodo [gizmodo.com]
- Washington Post [washingtonpost.com]
Re: (Score:2)
The /. editors are trash. Betcha $100 they never fix the link in the summary. They're completely incompetent.
What about the yoke? (Score:2)
Re: (Score:3)
It does, but as soon as they let go, the MCAS kicks in again, because it's still active, so if the pilot doesn't catch what's going on, they wind up fighting the aircraft all the way into the ground.
Single sensor? (Score:2)
For a system that can kill the aircraft? That sounds like criminal negligence to me. Somebody wanted to do things on the cheap obviously, ignoring all rules of the design of critical systems. In particular, you never, ever rely on a single sensor, and you make damn sure the operators (pilots) understand how things work. About 300 killed people later, Boeing seems to have remembered at least some of the basics.
Solution without a problem? (Score:2)
Just seems like a solution in search of a problem which often does not end well.
Re: (Score:2)
Stalling is a huge issue. In Air France Flight 447 [wikipedia.org], pilots stalled a large Airbus, because they were used to the automated anti-stall system. With the system in place, if you pull back on the stick the plane goes up. The pitot tubes plugged briefly. The system went to a manual mode (alternate law) that the pilots were unfamiliar with. The pilots pulled up, put the plane into a stall, and crashed the plane. They did not understand why they were not gaining altitude.
On average, it uses less fuel and is
The 2 crashes are even more related (Score:3)
Re: (Score:3)
https://en.wikipedia.org/wiki/... [wikipedia.org]
Flying is routine until it isn't. Planes are essentially balancing in the air. It doesn't take much to make one stop flying, and one momentary loss of attention at the wrong time or improper control input can end very badly. All of this x10 if the Pilots haven't been informed of or trained on the failure scenario they're encountering.
Re: (Score:2)
Well... What really happened is they ran out of fuel and although it was noticed by some of the crew, nobody thought it was important enough to interrupt the captain in the left seat as he was trying to make sure the wheels where down. Somebody should have been assigned to call out fuel status and not shut up even if the captain was fixated on that stupid light bulb.
It was one of the prompters for the Crew Resource Management movement, which makes subordinates more assertive while still maintaining the aut
Re: (Score:2)
They didn't run out of gas, they disengaged altitude hold mode on the autopilot inadvertently and didn't notice the loss of altitude in time to do anything about it. Widely used to teach pilots that someone has to keep flying the airplane while the rest of the crew debugs the situation.
Since you mention CRM you're probably thinking of a different accident, maybe Avianca Flight 52 (a Boeing 707) that was run out of gas... but that was mostly because the Captain didn't understand English and the co-pilot didn
Re: (Score:2)
Well... What really happened is they ran out of fuel and although it was noticed by some of the crew, nobody thought it was important enough to interrupt the captain in the left seat as he was trying to make sure the wheels where down.
You're thinking about United 173 [wikipedia.org] that crashed outside Portland, OR. Different accident from the "lightbulb" Eastern Airlines flight.
Re:Redundant Systems? (Score:4, Informative)
million dollar aircraft brought down by a cheap sensor failure
Well that's better than the aircraft accident I helped to investigate... The pilot died because of a power switch position he specifically set in order to turn off the system that prevented his aircraft from departing it's "flying" envelope by applying back pressure to his control inputs. When he went to "break" during some ACM training looking over his shoulder at his opponent, he applied too much rudder input, the aircraft snap rolled as it stopped flying and started to tumble, his head was caught between the ejection seat and the canopy and he died of a broken neck before his aircraft hit the water.
That guy died because he wanted the competitive edge and specifically tried to cheat by putting the aircraft in a forbidden configuration....
I'd rather die from a sensor failure than by some stupid mistake I made to get an unfair advantge because I want to win some competition..
Bad management: "sensor failure", not redundant. (Score:2)
Re: (Score:2)
Well, there's an obvious fix: Turn off the the control system that handles the anti-stall provisions that are likely at fault. Talking to my neighbor (AA pilot who's been trained on 737 Max 8), that was his comment. "It's pretty obvious the pilots need to be trained to turn off the system when they see that behavior."
But to an earlier comment: From the bit I know about commercial avionics safety, if there really is a single sensor that feeds into a control system, that does feel like a violation of safe
Re: (Score:2)
There are two AOA sensors. What the software does with their inputs is of course another matter. It seems like it would be nice to have three, but there other things that there are only two of (like engines on most commercial airliners) and pilot input is needed to respond to a failure of one. Of course, the pilot needs to understand that there's been a failure.
Re: (Score:2)
Your point about "know there's a failure" is relevant. But if the two sensors don't agree, then the '3rd factor' is the pilot. System reports "sensor failure" and the pilot turns off that anti-stall system. The rules as I understood them (I am not a safety engineer, but I've had some training in this area) is to use voting to detect the failure. For an engine, there are other ways to detect the failure than seeing if the engines are all turning at the same RPMs :-)
Re:The Tesla People (Score:4, Insightful)
It's funny how they point to aviation as nearly infallible when they talk about self-driving cars.
Well, it's a little less than one failure in four million flight hours, that's a pretty amazing safety record. If Tesla self-driving was one failure in four million driving hours, I'd call that very near infallible, compared to human drivers, anyway.
But when they do fail, it's spectacular, and makes news.
Source: http://planecrashinfo.com/caus... [planecrashinfo.com]
Re:The Tesla People (Score:5, Interesting)
It's funny how they point to aviation as nearly infallible when they talk about self-driving cars.
Self-driving cars don't have to be infallible. They just have to be safer than the average person, which is a really low bar.
Re: (Score:3)
Let us know when one gets there. All current claims are thoroughly debunked.
Re: (Score:2)
They just have to be safer than the average person, which is a really low bar.
Actually, they don't even need to be average, since the worst drivers will likely be the early adopters.
Re: (Score:2)
Re: (Score:2)
The pilot has always been able to turn off the system. Using the same two switches that turned off the equivalent (but different) system in previous versions.
Re: (Score:3)
Except up until recently 737MAX pilots didn't even know "the system" (MCAS) existed, which IMO is Boeing's biggest mistake in this matter.
Re: (Score:3)
They knew it existed but thought it had its old name. The same two switches turn both off.
Re: (Score:2)
Being able to turn it of and having actually been informed how to turn it off ans what it does are two different things. Boeing tried to keep this system secret, probably because pilots would have refused to fly a plane that has such a critical system dependent on a single sensor.
Re: (Score:2)
What's the alternative? Any pilot with an ATP endorsement has spun a few trim wheels.
Re: (Score:2)
I doubt very much than any senior, experienced engineer was in favor of this. It was very likely management that said "do it or look for a new job". Some will have looked for a new job instead, but some people cannot afford to.
Re: (Score:2)
One bad network card took out almost all of CenturyLink nation wide, including 911 services in many states, for several days.
So yeah, technology is fickle like that.
Re: (Score:2)
Re: (Score:2)
No spanning tree in that box? What cheap crap were you using?
Re: (Score:2)
Technology is fine. But redundancy costs money and an MBA moron telling an engineer to do it cheap or look for a new job can do untold damage.
Re: (Score:2)
If you ignore all principles of safety engineering, then it can. Otherwise it cannot. Seems that Boeing is doing on their planes what Intel does on its CPUs. If you optimize profits at any cost, things usually gets hugely expensive at some time.
Re: (Score:2)
A single engine failure can crash a twin engine plane -- if it happens at the wrong time and the pilot fails to initiate the documented corrective action. That's the case with a LOT of failures. After the Lion Air crash, every 737 MAX pilot knows how to detect an deal with that problem so there's no excuse for a repeat (if the Ethiopian Airline crash was a repeat - which I'm not confident of given the witness reports that the plane was on fire on the way down to the crash site).
Re: (Score:2)
The have the "bitching betty" who will say "terrain, pull up.... Terrain, Pull up.."
But if the aircraft is fighting you on the "pull up" because the stall avoidance system is run amuck I can see how the mixed signals would be confusing.
Also, it may not be obvious but "Lowest safe value" is constantly changing as you fly around and the way you measure altitude is subject to knowing the local barometric pressure with enough precision, data that the pilots generally provide.
Re: Back in my day,... (Score:3)
Re: (Score:2)
Yep -- and the fatality rate per passenger mile was much higher "back in the day".
Re: (Score:2)
... after the Lion Air crash, knew of the needed fix
Boeing doing something while nobody is requesting a change is highly suspicious, and could be seen as an acknowledgement of responsibility.
Re: (Score:2)