12 ms·

Before this incidence, at least 3 to 4 accidents occurred where the pilot was in fault. Like : They were pulling the sticks too high. The autopilot was screamin

by z92 8y ago

Before this incidence, at least 3 to 4 accidents occurred where the pilot was in fault. Like : They were pulling the sticks too high. The autopilot was screaming "Stall" "Stall". But the pilots were too busy or incompetent to notice. And ultimately crashed the plane. I remember here in HN, there were cries why auto pilot didn't take over at that time and save lives. "Pilots should never be allowed to stall the plane." Well, Boeing's new software did exactly that. Correct the situation when the pilot wasn't. And that crashed the plane. Interesting indeed. Lesson: There's a lot to look beyond before taking a decision, even when the obvious decision is just in front of everyone.

openplatypus 8y ago
They did just that but they approach problem badly. Article suggests that pilot didn't know about new system nor how to disable it. In case of faulty sensor (Boeing can't stupid enough not to have quorum of sensors, can it?) crew should be able to disable possibly deadly autopilot. 1. YES - for automation 2. YES - for sensible and safe handling of sensor failure 3. YES - for allow human to override auto-pilot
- azifali 8y ago
  Rookie pilot here. Large airplanes have drive by wire systems where the plane pretty much flies itself. But when certain instruments like the Pitot tube don't work then the control is handed over to pilots and they operate in alternate law, where they are responsible for the actions. If instruments cannot measure key environmental indicators such as velocity, temperature etc - no amount of automation will save the plane. Instrument meteorological conditions (IMC) / Instrument Flight Rating (IFR) flights are when the plane is flying through darkness, or through conditions that do not allow for a judgement of the visual elements and therefore pilots can easily make incorrect judgement calls on the position of the plane, leading to a crash. The pitot tube is a primitive equipment to measure wind velocity and easily can be jammed by ice, insects etc. I think it was the Pitot tube malfunction in this plane that caused the incident.
  - inferiorhuman 8y ago
    What's being called into question here is the alpha vane (which measures the angle of attack) and AoA disagree warning -- of which the 737 has two and none respectively. This means that there's no quorum (need 3+ vanes for that) and no way for the pilots to know if there's a problem with the AoA data being fed into the computers. I believe the issue is that this hidden system (MCAS) relies on AoA data which can, per the above, not be validated by the pilots or the computers. Thus the fear is that the plane will go full nose down for no obvious reason. Granted the emergency AD indicates some secondary indicators that your AoA vanes have gone wonky. Per the AA email: > The MCAS function becomes active when the airplane Angle of Attack exceeds a threshold based on airspeed and altitude. Stabilizer incremental commands are limited to 2.5 degrees and are provided at a rate of 0.27 degrees per second. The magnitude of the stabilizer input is lower at high Mach number and greater at low Mach numbers. The function is reset once angle of attack falls below the Angle of Attack threshold or if manual stabilizer commands are provided by the flight crew. If the original elevated AOA condition persists, the MCAS function commands another incremental stabilizer nose down command according to current aircraft Mach number at actuation. IOW hey the plane might try to kill you and while you're busy trying not to die at 5,000 ft please disable the electronic aids and grab the trim wheels by hand. Noting, of course, that it take the computer ~30 seconds to move the stabilizer from one end of its travel to the other. It'll take a person longer if you're cranking it by hand. This is, of course, all after the pilots have realized what the problem actually is. All of this at five thousand feet where you might not have 30 seconds to respond. I'd suggest that if this scenario is at all close to what transpired those pilots didn't have a chance.
    - FabHK 8y ago
      > no way for the pilots to know if there's a problem with the AoA data Just to clarify, with two AoA sensors, you can know that there is a problem (if they disagree), but you don't know which one is erroneous. What I find surprising about this crash is that even if there's an indication of unreliable readings, the automation proceeds to actively do stuff - I thought Boeing philosophy was to hand everything to the pilots in such a case. > I'd suggest that if this scenario is at all close to what transpired those pilots didn't have a chance. Yeah, absolutely devastating. In the time they had, how were they supposed to diagnose that error condition (automatic down trim), given that a) it sneakily recurs every now and then, and b) it was not prepared/trained for?
- deleted 8y ago
  [deleted]
Cthulhu_ 8y ago
Pilots SHOULD be trained to deal with situations like this - getting trained in simulators replicating the conditions that caused previous accidents. But, that's theoretical. I'm hearing pilots get massively underpaid for the responsibility they have, unless they gain an x amount of flight hours and years of experience so they can do big intercontinental flights (= more flight hours, = more income). It's up to the industry to fix this problem, also to fix their own shortage of pilots. Pay pilots a decent wage when they're starting out on their career. Give them the opportunities to gain the flight hours.
- ainiriand 8y ago
  Maybe in the US, here in EU even the newest Ryanair pilot makes 100k. https://careers.ryanair.com/pilots/pilotpayincreases/ https://careers.ryanair.com/pilots/pilotpayincreases/
  - colde 8y ago
    Yeah, thats not true. The chart you link to says new first officers based in Dublin make 78.400 EUR (with "Productivity" which might not be guaranteed). And since Stansted Captain salary is lower, i would suggest that Stansted FO salaries would be lower too. Additionally, other bases in southern Europe might be even worse.
    - ainiriand 8y ago
      You are right, the figures are misleading and do not represent EU pilot salaries. Apologies for the error.
  - alistairSH 8y ago
    In the US, new commercial pilots (with ATP license) earn somewhere in the $20k-$40k range.[1] And many take on massive debt for the privilege - college degree and flight training together can cost upwards of $200k.[2] 1 - http://fortune.com/2014/03/03/why-airlines-are-running-out-of-pilots/ http://fortune.com/2014/03/03/why-airlines-are-running-out-o... 2 - https://daytonabeach.erau.edu/admissions/estimated-costs/ https://daytonabeach.erau.edu/admissions/estimated-costs/
the_mitsuhiko 8y ago
But apparently it was still possible to put the plane into a mode where it crashed. A lot of previous conversations about this topic were related to airbus flight control laws.
daveoflynn 8y ago
That analogy doesn’t hold up. All Airbus and most Boeing aircraft have systems to push the nose down in event of a stall. The problem here is: in the transition from the -NG to the -MAX, Boeing added this protection and didn’t tell anyone. Imagine someone added Adaptive Cruise Control to your existing car without telling you - the first time the car braked on its own, you’d freak out. The car is suddenly behaving in a way it should be able to. If you know the system exists, you can recognise what’s happening and deal with it. If you don’t know it exists, the behaviour is going to be absolutely baffling, and no in-flight diagnostic procedure has a step for “did the manufacturer add an important safety device and not tell me?”
- stef25 8y ago
  > The problem here is: in the transition from the -NG to the -MAX, Boeing added this protection and didn’t tell anyone Totally out of my depth here, but how is it possible that they "didn't tell anyone" about a feature so crucial, how could pilots not know how the plane's computer will behave in such a fundamental, non edge-case scenario?
  - slededit 8y ago
    Boeing specifically marketed this as not requiring new training. So they did everything they could to hide it in order to satisfy marketing’s desire. The FAA signed off. I guess the lawyers will argue if it was legal or not.
    - tmd83 8y ago
      That's what I'm wondering about. How did Boeing get away without disclosing it. Or if they disclose it how did FAA agree that this is not something that pilots need to know and train for. If they signed off on Boeing not letting pilots know FAA should be on the hook for this too.
    - raverbashing 8y ago
      A stick Pusher is not a new feature, if you're right, and the FAA signed off that operators of the NG did not need any supplementary training and that caused the accident that will be very ugly for Boeing
FabHK 8y ago
Yeah. Another example: the terrorist-proof cockpit doors, which enabled suicidal co-pilot Lubitz to fly Germanwings Flight 9525 straight into the French Alps. I guess a good thing to note about this is that aviation is so close to optimum safety level that it's hard to find unambiguous ("pareto") improvements; you can just find a different tradeoff. The gradient is pretty close to zero.
- DoctorOetker 8y ago
  One might argue the problem was not the attempt to make systems resilient, but rather the attack model was too narrow: What if a malicious pilot had been part of the threat model? instead of terrorist-proof cockpit doors, attacker-proof cockpit doors: split the cockpit in half (strong plexiglass), each has their own combination code for their own door. As soon as one pilot starts disobeying ATC, they can choose which pilot gets control of the airplane... True, the pilots can no longer circle j* during their boring flights...
  - nradov 8y ago
    Those are terrible ideas. No one can foresee all possible threats, or reliably predict which ones will come to pass. It's not possible to split cockpits down the middle because some critical controls such as circuit breakers exist only one one side or the other, but are reachable by both pilots. Adding duplicate circuit breakers on both sides isn't practical for space reasons, and would introduce additional failure points. And allowing ATC to block out a pilot from flight controls would itself be a failure point. What if ATC is compromised?
    - DoctorOetker 8y ago
      >Those are terrible ideas. To the extent the ideas from the peanut gallery are terrible, it is because intellectual property does not allow the peanut gallery to inspect the full airplane designs, schematics etc... I feel confident the community at large (or the relatives and acquaintances of the deceased and their lawyers and or engineers they appoint) could provide better criticisms. But if my aunt had balls she would have been my uncle: intellectual property kills. What is the statistical value of a human life? What is the statistical value of intellectual property? >No one can foresee all possible threats, or reliably predict which ones will come to pass. I think that is an open question. But let's pretend you are right for the sake of argument. Improvement does not necessitate foreseeing all problems, excluding failure modes as they are discovered is still improvement, even if they aren't absolute panaceas. >It's not possible to split cockpits down the middle because some critical controls such as circuit breakers exist only one one side or the other, but are reachable by both pilots. Adding duplicate circuit breakers on both sides isn't practical for space reasons, and would introduce additional failure points. Space reasons? I'm sure the passengers appreciated their extra millimeter of legroom while crashing into the alps... why not each their own breaker and the circuit only breaks when their breakers agree on breaking? i.e. logical AND. Yes any additional complexity would make the problem space more complex, and should be dealt with using formal verification etc... >And allowing ATC to block out a pilot from flight controls would itself be a failure point. What if ATC is compromised? Obviously, the plane only listens to ATC pilot selection when one pilot disagrees (visualize a big red disagree button if you will). As long as none of the pilots has the disagree button engaged the plane ignores ATC. ATC can not initiate selection of pilot. Yes there situations that still admit malicious pilots like: collusion between 2 pilots, collusion between a pilot and an ATC controller. Use things like sortition, and reward ratting out proposals of collusion... Edit: spelling
deleted 8y ago
[deleted]
amelius 8y ago
Pilots have a license to fly specific airplane models only. They are trained for each new model.
- FabHK 8y ago
  From what I gather, they have a license for a specific category (airplane) and class (multi engine land), and then (above some threshold) require type ratings for specific types.
  - amelius 8y ago
    Ok, well perhaps that's a problem right there.
myth2018 8y ago
There are a bunch of situations where the autopilot in fact turns itself off. For instance, when the sensors are providing faulty readings. And, coincidentally or not, the plane had had one of its sensors replaced a day or two before the crash. So, a priori, I wouldn't be so sure that the pilots should just have let the embedded software free to do its job. It may have been the case, of course, but only the investigation could tell.

by z92 8y ago

openplatypus 8y ago

They did just that but they approach problem badly. Article suggests that pilot didn't know about new system nor how to disable it. In case of faulty sensor (Boeing can't stupid enough not to have quorum of sensors, can it?) crew should be able to disable possibly deadly autopilot. 1. YES - for automation 2. YES - for sensible and safe handling of sensor failure 3. YES - for allow human to override auto-pilot

azifali 8y ago
Rookie pilot here. Large airplanes have drive by wire systems where the plane pretty much flies itself. But when certain instruments like the Pitot tube don't work then the control is handed over to pilots and they operate in alternate law, where they are responsible for the actions. If instruments cannot measure key environmental indicators such as velocity, temperature etc - no amount of automation will save the plane. Instrument meteorological conditions (IMC) / Instrument Flight Rating (IFR) flights are when the plane is flying through darkness, or through conditions that do not allow for a judgement of the visual elements and therefore pilots can easily make incorrect judgement calls on the position of the plane, leading to a crash. The pitot tube is a primitive equipment to measure wind velocity and easily can be jammed by ice, insects etc. I think it was the Pitot tube malfunction in this plane that caused the incident.
- inferiorhuman 8y ago
  What's being called into question here is the alpha vane (which measures the angle of attack) and AoA disagree warning -- of which the 737 has two and none respectively. This means that there's no quorum (need 3+ vanes for that) and no way for the pilots to know if there's a problem with the AoA data being fed into the computers. I believe the issue is that this hidden system (MCAS) relies on AoA data which can, per the above, not be validated by the pilots or the computers. Thus the fear is that the plane will go full nose down for no obvious reason. Granted the emergency AD indicates some secondary indicators that your AoA vanes have gone wonky. Per the AA email: > The MCAS function becomes active when the airplane Angle of Attack exceeds a threshold based on airspeed and altitude. Stabilizer incremental commands are limited to 2.5 degrees and are provided at a rate of 0.27 degrees per second. The magnitude of the stabilizer input is lower at high Mach number and greater at low Mach numbers. The function is reset once angle of attack falls below the Angle of Attack threshold or if manual stabilizer commands are provided by the flight crew. If the original elevated AOA condition persists, the MCAS function commands another incremental stabilizer nose down command according to current aircraft Mach number at actuation. IOW hey the plane might try to kill you and while you're busy trying not to die at 5,000 ft please disable the electronic aids and grab the trim wheels by hand. Noting, of course, that it take the computer ~30 seconds to move the stabilizer from one end of its travel to the other. It'll take a person longer if you're cranking it by hand. This is, of course, all after the pilots have realized what the problem actually is. All of this at five thousand feet where you might not have 30 seconds to respond. I'd suggest that if this scenario is at all close to what transpired those pilots didn't have a chance.
  - FabHK 8y ago
    > no way for the pilots to know if there's a problem with the AoA data Just to clarify, with two AoA sensors, you can know that there is a problem (if they disagree), but you don't know which one is erroneous. What I find surprising about this crash is that even if there's an indication of unreliable readings, the automation proceeds to actively do stuff - I thought Boeing philosophy was to hand everything to the pilots in such a case. > I'd suggest that if this scenario is at all close to what transpired those pilots didn't have a chance. Yeah, absolutely devastating. In the time they had, how were they supposed to diagnose that error condition (automatic down trim), given that a) it sneakily recurs every now and then, and b) it was not prepared/trained for?
deleted 8y ago
[deleted]

Cthulhu_ 8y ago

Pilots SHOULD be trained to deal with situations like this - getting trained in simulators replicating the conditions that caused previous accidents. But, that's theoretical. I'm hearing pilots get massively underpaid for the responsibility they have, unless they gain an x amount of flight hours and years of experience so they can do big intercontinental flights (= more flight hours, = more income). It's up to the industry to fix this problem, also to fix their own shortage of pilots. Pay pilots a decent wage when they're starting out on their career. Give them the opportunities to gain the flight hours.

ainiriand 8y ago
Maybe in the US, here in EU even the newest Ryanair pilot makes 100k. https://careers.ryanair.com/pilots/pilotpayincreases/ https://careers.ryanair.com/pilots/pilotpayincreases/
- colde 8y ago
  Yeah, thats not true. The chart you link to says new first officers based in Dublin make 78.400 EUR (with "Productivity" which might not be guaranteed). And since Stansted Captain salary is lower, i would suggest that Stansted FO salaries would be lower too. Additionally, other bases in southern Europe might be even worse.
  - ainiriand 8y ago
    You are right, the figures are misleading and do not represent EU pilot salaries. Apologies for the error.
- alistairSH 8y ago
  In the US, new commercial pilots (with ATP license) earn somewhere in the $20k-$40k range.[1] And many take on massive debt for the privilege - college degree and flight training together can cost upwards of $200k.[2] 1 - http://fortune.com/2014/03/03/why-airlines-are-running-out-of-pilots/ http://fortune.com/2014/03/03/why-airlines-are-running-out-o... 2 - https://daytonabeach.erau.edu/admissions/estimated-costs/ https://daytonabeach.erau.edu/admissions/estimated-costs/

the_mitsuhiko 8y ago

But apparently it was still possible to put the plane into a mode where it crashed. A lot of previous conversations about this topic were related to airbus flight control laws.

daveoflynn 8y ago

That analogy doesn’t hold up. All Airbus and most Boeing aircraft have systems to push the nose down in event of a stall. The problem here is: in the transition from the -NG to the -MAX, Boeing added this protection and didn’t tell anyone. Imagine someone added Adaptive Cruise Control to your existing car without telling you - the first time the car braked on its own, you’d freak out. The car is suddenly behaving in a way it should be able to. If you know the system exists, you can recognise what’s happening and deal with it. If you don’t know it exists, the behaviour is going to be absolutely baffling, and no in-flight diagnostic procedure has a step for “did the manufacturer add an important safety device and not tell me?”

stef25 8y ago
> The problem here is: in the transition from the -NG to the -MAX, Boeing added this protection and didn’t tell anyone Totally out of my depth here, but how is it possible that they "didn't tell anyone" about a feature so crucial, how could pilots not know how the plane's computer will behave in such a fundamental, non edge-case scenario?
- slededit 8y ago
  Boeing specifically marketed this as not requiring new training. So they did everything they could to hide it in order to satisfy marketing’s desire. The FAA signed off. I guess the lawyers will argue if it was legal or not.
  - tmd83 8y ago
    That's what I'm wondering about. How did Boeing get away without disclosing it. Or if they disclose it how did FAA agree that this is not something that pilots need to know and train for. If they signed off on Boeing not letting pilots know FAA should be on the hook for this too.
  - raverbashing 8y ago
    A stick Pusher is not a new feature, if you're right, and the FAA signed off that operators of the NG did not need any supplementary training and that caused the accident that will be very ugly for Boeing

FabHK 8y ago

Yeah. Another example: the terrorist-proof cockpit doors, which enabled suicidal co-pilot Lubitz to fly Germanwings Flight 9525 straight into the French Alps. I guess a good thing to note about this is that aviation is so close to optimum safety level that it's hard to find unambiguous ("pareto") improvements; you can just find a different tradeoff. The gradient is pretty close to zero.

DoctorOetker 8y ago
One might argue the problem was not the attempt to make systems resilient, but rather the attack model was too narrow: What if a malicious pilot had been part of the threat model? instead of terrorist-proof cockpit doors, attacker-proof cockpit doors: split the cockpit in half (strong plexiglass), each has their own combination code for their own door. As soon as one pilot starts disobeying ATC, they can choose which pilot gets control of the airplane... True, the pilots can no longer circle j* during their boring flights...
- nradov 8y ago
  Those are terrible ideas. No one can foresee all possible threats, or reliably predict which ones will come to pass. It's not possible to split cockpits down the middle because some critical controls such as circuit breakers exist only one one side or the other, but are reachable by both pilots. Adding duplicate circuit breakers on both sides isn't practical for space reasons, and would introduce additional failure points. And allowing ATC to block out a pilot from flight controls would itself be a failure point. What if ATC is compromised?
  - DoctorOetker 8y ago
    >Those are terrible ideas. To the extent the ideas from the peanut gallery are terrible, it is because intellectual property does not allow the peanut gallery to inspect the full airplane designs, schematics etc... I feel confident the community at large (or the relatives and acquaintances of the deceased and their lawyers and or engineers they appoint) could provide better criticisms. But if my aunt had balls she would have been my uncle: intellectual property kills. What is the statistical value of a human life? What is the statistical value of intellectual property? >No one can foresee all possible threats, or reliably predict which ones will come to pass. I think that is an open question. But let's pretend you are right for the sake of argument. Improvement does not necessitate foreseeing all problems, excluding failure modes as they are discovered is still improvement, even if they aren't absolute panaceas. >It's not possible to split cockpits down the middle because some critical controls such as circuit breakers exist only one one side or the other, but are reachable by both pilots. Adding duplicate circuit breakers on both sides isn't practical for space reasons, and would introduce additional failure points. Space reasons? I'm sure the passengers appreciated their extra millimeter of legroom while crashing into the alps... why not each their own breaker and the circuit only breaks when their breakers agree on breaking? i.e. logical AND. Yes any additional complexity would make the problem space more complex, and should be dealt with using formal verification etc... >And allowing ATC to block out a pilot from flight controls would itself be a failure point. What if ATC is compromised? Obviously, the plane only listens to ATC pilot selection when one pilot disagrees (visualize a big red disagree button if you will). As long as none of the pilots has the disagree button engaged the plane ignores ATC. ATC can not initiate selection of pilot. Yes there situations that still admit malicious pilots like: collusion between 2 pilots, collusion between a pilot and an ATC controller. Use things like sortition, and reward ratting out proposals of collusion... Edit: spelling

deleted 8y ago

[deleted]

amelius 8y ago

Pilots have a license to fly specific airplane models only. They are trained for each new model.

FabHK 8y ago
From what I gather, they have a license for a specific category (airplane) and class (multi engine land), and then (above some threshold) require type ratings for specific types.
- amelius 8y ago
  Ok, well perhaps that's a problem right there.

myth2018 8y ago

There are a bunch of situations where the autopilot in fact turns itself off. For instance, when the sensors are providing faulty readings. And, coincidentally or not, the plane had had one of its sensors replaced a day or two before the crash. So, a priori, I wouldn't be so sure that the pilots should just have let the embedded software free to do its job. It may have been the case, of course, but only the investigation could tell.