9 ms·

They mention it once in the article, but this has basically been true since fly-by-wire, which was quite a while ago. While it may seem timely to blame automat

by cbanek 9y ago

They mention it once in the article, but this has basically been true since fly-by-wire, which was quite a while ago. While it may seem timely to blame automation for this one, you could just as easily blame faulty sensors (like the iced up sensors they mention) or faulty mechanicals, such as pumps, hydraulics, wiring, electrical shorts, etc. The sad thing is, as we go faster (both in terms of speed and technology), things will only get more complex. We're also far past the point where human pilots and crew might be able to do something about it. Let's say it wasn't fly-by-wire, and it was hydraulics tied to the stick. If you lost power, you still probably wouldn't be able to move the stick, or it wouldn't do anything. Either way you are in deep trouble. The real solution is redundancy. They mention the triple flight computers in the Airbus, but in the end, there will always be possible problems of all types. In computers, there are also hardware (not software bugs) errors that may occur at any time. One of the things devs love to joke about is heisenbugs. If you have debugged these, and only found them on one machine, it's probably your memory doing a bit-flip. Solar radiation can do that, especially at higher altitudes. Just because we're behind our magnetic field doesn't make it go away, and at higher altitudes you do have a slightly higher error rate. Now we're just back to byzantine general territory where you have to figure out which one is lying. Again, coming down to probability that you didn't lose two at the same time. While it's easy to say that the system should have just done "the right thing" - when you learn more about how the system works, and how complicated it is, you realize how hard that is. And problems in handling errors or trouble are some of the hardest to find, and have the most damaging consequences. Spacecraft (manned or otherwise) have these exact same problems. (Source: I've worked on aerospace systems) https://en.wikipedia.org/wiki/Fly-by-wire https://en.wikipedia.org/wiki/Fly-by-wire

caf 9y ago
...you could just as easily blame faulty sensors... Well, no - faulty sensors are an inevitability, so the automation needs to be able to continue to function effectively in that eventuality. Which is, of course, a well-understood part of the design space.
- cbanek 9y ago
  Everything is an inevitability, that's the problem with the design space. We haven't yet invented some perfect machine that will handle everything. But there are functional and realistic limits to how well you can perform under certain failure scenarios. You might have to increase weight to add more sensors and wiring. That logic to reconcile more sensors will be more complex, and possibly prone to error itself. Added complexity against failure doesn't necessarily increase safety, as much as we always wish it would.
  - akira2501 9y ago
    > Everything is an inevitability, that's the problem with the design space. We haven't yet invented some perfect machine that will handle everything. In the case of this flight, and the less fortunate Air Fance 447; it was a failure of a single sensor that caused loss of stable flight.. yet, there were still two other sensors that continued to function correctly. In both cases, the fix is to turn a switch so that the primary flight display and auto pilot start getting their data from one of the alternate sources. Without having done a complex study, my impression is that there is a lack of pilot training when it comes to properly managing and understanding flight data sources and paths in modern aircraft.
    - sitkack 9y ago
      Relying on just pitot tubes, even in multiples is dumb. Inertial guidance, GPS, GLONASS, etc. Feed it all into a Kalman filter. 447 would still be around if the autopilot didn't kick off.
      - ddalex 9y ago
        You could say the same about everything - AF447 would still be here if Bonin, the co-pilot, would not have pulled the stick while the plane clearly stalled, because he wanted the plane to 'go up'.
        9y ago
bsamuels 9y ago
> If you lost power, you still probably wouldn't be able to move the stick, or it wouldn't do anything. item of interest: some commercial aircraft have a mechanical flight control mode where the pilot can mechanically control some of the control surfaces. not sure if this applies to many other aircraft though.
- akira2501 9y ago
  Not available on an Airbus.. there is no mechanical linkage from the flight stick to anything other than it's own housing. However, on both the modern Airbus and Boeing plans, there's a RAT[1] that will generate hydraulic and electrical power if the planes main and auxiliary systems fail. The (in)famous Gimli Glider[2] used it to survive total power loss after it ran it's fuel tanks dry. [1]:https://en.wikipedia.org/wiki/Ram_air_turbine https://en.wikipedia.org/wiki/Ram_air_turbine [2]:https://en.wikipedia.org/wiki/Gimli_Glider https://en.wikipedia.org/wiki/Gimli_Glider
- WalterBright 9y ago
  On the 757, the pilot's controls move steel cables which open and close the valves on hydraulic rams which move the surfaces. Hydraulic power is necessary, which is why there's the backup RAT to supply enough hydraulic pressure to run the primary flight controls if the engines all fail. A "feel computer" pushes back on the pilot's controls so moving the controls feels like it would on a machine where the surfaces were connected to the cables. I'm pretty sure the 757 can be flown with no electric power.
pdonis 9y ago
> We're also far past the point where human pilots and crew might be able to do something about it. I disagree. In the incident described in the article, the pilot could have prevented all of the damage--if only the airplane had responded to his control inputs. This was not a situation that would have been hard for a human to handle--if the human had had the ability to tell the airplane: stop listening to the computers and just listen to me. > The real solution is redundancy. There was plenty of redundancy in this case. It didn't help. I think the real solution is, as I said above, to give the human pilot a last-ditch way of regaining complete manual control of the plane. After all, that's what the human is there for: to intervene if it is clear that the automation is doing the wrong thing. That was clearly the case here, but the humans had no way to stop it. That is not a good idea.
- cbanek 9y ago
  > I think the real solution is, as I said above, to give the human pilot a last-ditch way of regaining complete manual control of the plane. This was my point all along, there is no such thing as "manual control" anymore. It's all a big system working in concert, even moving the control surfaces. And as systems get more complicated, and start to require faster than human response speeds, it will be even less "manual control".
  - pdonis 9y ago
    > there is no such thing as "manual control" anymore It's one thing to not have direct hydraulic or mechanical connections to the control surfaces. You can still have a direct wire from the controls in the cockpit to the actuators that move the control surfaces, with no computer intervention. It's another thing to have no way to get the faulty computers out of the way and get that direct wire to the actuators. > as systems get more complicated, and start to require faster than human response speeds That might be the case for some systems, but it isn't the case for airliners. If it were, humans would not have been able to fly them before fly-by-wire controlled by computers came along.
    - cbanek 9y ago

by cbanek 9y ago

caf 9y ago

...you could just as easily blame faulty sensors... Well, no - faulty sensors are an inevitability, so the automation needs to be able to continue to function effectively in that eventuality. Which is, of course, a well-understood part of the design space.

cbanek 9y ago
Everything is an inevitability, that's the problem with the design space. We haven't yet invented some perfect machine that will handle everything. But there are functional and realistic limits to how well you can perform under certain failure scenarios. You might have to increase weight to add more sensors and wiring. That logic to reconcile more sensors will be more complex, and possibly prone to error itself. Added complexity against failure doesn't necessarily increase safety, as much as we always wish it would.
- akira2501 9y ago
  > Everything is an inevitability, that's the problem with the design space. We haven't yet invented some perfect machine that will handle everything. In the case of this flight, and the less fortunate Air Fance 447; it was a failure of a single sensor that caused loss of stable flight.. yet, there were still two other sensors that continued to function correctly. In both cases, the fix is to turn a switch so that the primary flight display and auto pilot start getting their data from one of the alternate sources. Without having done a complex study, my impression is that there is a lack of pilot training when it comes to properly managing and understanding flight data sources and paths in modern aircraft.
  - sitkack 9y ago
    Relying on just pitot tubes, even in multiples is dumb. Inertial guidance, GPS, GLONASS, etc. Feed it all into a Kalman filter. 447 would still be around if the autopilot didn't kick off.
    - ddalex 9y ago
      You could say the same about everything - AF447 would still be here if Bonin, the co-pilot, would not have pulled the stick while the plane clearly stalled, because he wanted the plane to 'go up'.
      - 9y ago

bsamuels 9y ago

> If you lost power, you still probably wouldn't be able to move the stick, or it wouldn't do anything. item of interest: some commercial aircraft have a mechanical flight control mode where the pilot can mechanically control some of the control surfaces. not sure if this applies to many other aircraft though.

akira2501 9y ago
Not available on an Airbus.. there is no mechanical linkage from the flight stick to anything other than it's own housing. However, on both the modern Airbus and Boeing plans, there's a RAT[1] that will generate hydraulic and electrical power if the planes main and auxiliary systems fail. The (in)famous Gimli Glider[2] used it to survive total power loss after it ran it's fuel tanks dry. [1]:https://en.wikipedia.org/wiki/Ram_air_turbine https://en.wikipedia.org/wiki/Ram_air_turbine [2]:https://en.wikipedia.org/wiki/Gimli_Glider https://en.wikipedia.org/wiki/Gimli_Glider
WalterBright 9y ago
On the 757, the pilot's controls move steel cables which open and close the valves on hydraulic rams which move the surfaces. Hydraulic power is necessary, which is why there's the backup RAT to supply enough hydraulic pressure to run the primary flight controls if the engines all fail. A "feel computer" pushes back on the pilot's controls so moving the controls feels like it would on a machine where the surfaces were connected to the cables. I'm pretty sure the 757 can be flown with no electric power.

pdonis 9y ago

> We're also far past the point where human pilots and crew might be able to do something about it. I disagree. In the incident described in the article, the pilot could have prevented all of the damage--if only the airplane had responded to his control inputs. This was not a situation that would have been hard for a human to handle--if the human had had the ability to tell the airplane: stop listening to the computers and just listen to me. > The real solution is redundancy. There was plenty of redundancy in this case. It didn't help. I think the real solution is, as I said above, to give the human pilot a last-ditch way of regaining complete manual control of the plane. After all, that's what the human is there for: to intervene if it is clear that the automation is doing the wrong thing. That was clearly the case here, but the humans had no way to stop it. That is not a good idea.

cbanek 9y ago
> I think the real solution is, as I said above, to give the human pilot a last-ditch way of regaining complete manual control of the plane. This was my point all along, there is no such thing as "manual control" anymore. It's all a big system working in concert, even moving the control surfaces. And as systems get more complicated, and start to require faster than human response speeds, it will be even less "manual control".
- pdonis 9y ago
  > there is no such thing as "manual control" anymore It's one thing to not have direct hydraulic or mechanical connections to the control surfaces. You can still have a direct wire from the controls in the cockpit to the actuators that move the control surfaces, with no computer intervention. It's another thing to have no way to get the faulty computers out of the way and get that direct wire to the actuators. > as systems get more complicated, and start to require faster than human response speeds That might be the case for some systems, but it isn't the case for airliners. If it were, humans would not have been able to fly them before fly-by-wire controlled by computers came along.
  - cbanek 9y ago