3 ms·

The system needs to realize that there is a sensor failure. If the Lion Air crash is due to a faulty sensor Boeing needs to answer some serious questions: 1. W

by chopin 8y ago

The system needs to realize that there is a sensor failure. If the Lion Air crash is due to a faulty sensor Boeing needs to answer some serious questions: 1. Why did they not inform operators about changed system behavior? 2. Why wasn't the system capable of detecting sensor failure and/or act accordingly? In the automation industry one goes to great length to be able to tell good sensors apart from bad ones. Why was that not the case here? If it is not possible to tell bad sensors from good ones, why wasn't there (sufficient) redundancy (=multiple sensors) which at least deactivate the system on conflicting input?

FabHK 8y ago
Re 2: There are two AoA sensors. However, good question - why aren't there 3 (so you can have majority quorum in case of one failure), and why wasn't automation disabled once a discrepancy between the 2 existing ones was detected?
- Serow225 8y ago
  Cost.
- Zak 8y ago
  I've seen a similar failure in a van. The van was equipped with antilock brakes, which override the driver's control input and reduce braking force when the speed sensors on one or more wheels detect that the wheel has stopped too suddenly, as if skidding. One of the sensors had malfunctioned, resulting in an "ABS" warning light, and a fault code readable with a tool indicating which sensor was malfunctioning. Did it disable the ABS? No. Instead, it continued to rely on the faulty sensor information, activating ABS under moderate deceleration on dry pavement, greatly reducing the available braking force and creating a severe danger. I think there may be a bias among people designing safety equipment to always try to provide the intended safety benefit, even when part of the system isn't working. The problem is it's easy to lose sight of how the safety feature fits into the overall picture. A pilot can almost always safely fly a plane that doesn't use automation to recover from a stall, but not necessarily one that uses the trim to point the nose at the ground in spite of control inputs to the contrary.

by chopin 8y ago

FabHK 8y ago

Re 2: There are two AoA sensors. However, good question - why aren't there 3 (so you can have majority quorum in case of one failure), and why wasn't automation disabled once a discrepancy between the 2 existing ones was detected?

Serow225 8y ago
Cost.
Zak 8y ago
I've seen a similar failure in a van. The van was equipped with antilock brakes, which override the driver's control input and reduce braking force when the speed sensors on one or more wheels detect that the wheel has stopped too suddenly, as if skidding. One of the sensors had malfunctioned, resulting in an "ABS" warning light, and a fault code readable with a tool indicating which sensor was malfunctioning. Did it disable the ABS? No. Instead, it continued to rely on the faulty sensor information, activating ABS under moderate deceleration on dry pavement, greatly reducing the available braking force and creating a severe danger. I think there may be a bias among people designing safety equipment to always try to provide the intended safety benefit, even when part of the system isn't working. The problem is it's easy to lose sight of how the safety feature fits into the overall picture. A pilot can almost always safely fly a plane that doesn't use automation to recover from a stall, but not necessarily one that uses the trim to point the nose at the ground in spite of control inputs to the contrary.