4 ms·

Relevant (about the first crash): https://www.21stcentech.com/bad-software-boeing-737-max-commercial-jet/ https://www.21stcentech.com/bad-software-boeing-737-m

by acqq 8y ago

Relevant (about the first crash): https://www.21stcentech.com/bad-software-boeing-737-max-commercial-jet/ https://www.21stcentech.com/bad-software-boeing-737-max-comm... "Those 189 who died were victims of Boeing’s redesign of its successful 737 aircraft, all about putting a bigger engine on it and trying to come up with a solution to correct the airplane’s changed aerodynamics. Boeing realized the redesign could lead to potential stalls. MCAS was the answer" "Software combined with sensors would ensure the airplane would not tilt upward at an unsafe rate. The combination of the two would keep the nose at the precise right angle during all aspects of flight to prevent a potential stall. Was this, in the end, a good design decision? No based on what occurred to this nearly brand new aircraft" "Pilots can manually override the MCAS but cannot switch it off without switching off the flight computer. This fact in and of itself proved fatal to Flight 610, its crew, and passengers." "Since the crash Boeing has sent out a safety warning with a procedure for cutting off MCAS in the event of an AOA sensor malfunction. A description of what a pilot would experience should the MCAS receive false data has been included so that he or she would know when to disengage the flight computer and manually take over flying the plane." Moreover, bad software effectively working against the pilots, again connected to the stalls, was also the cause of this famous accident some 10 years ago: https://en.wikipedia.org/wiki/Air_France_Flight_447 https://en.wikipedia.org/wiki/Air_France_Flight_447 "In an article in Vanity Fair, William Langewiesche noted that once the angle of attack was so extreme, the system rejected the data as invalid and temporarily stopped the stall warnings. However, "this led to a perverse reversal that lasted nearly to the impact: each time Bonin happened to lower the nose, rendering the angle of attack marginally less severe, the stall warning sounded again—a negative reinforcement that may have locked him into his pattern of pitching up", which increased the angle of attack and thus prevented the aircraft from getting out of its stall.[25]"

youngtaff 8y ago
This is so important… most airlines are inherently stable by design but the 737 Max requires software to be stable
- twtw 8y ago
  No, it doesn't. The 737 max has software to prevent stalls in situations outside of the profile of normal flight. As does e.g. the A320.
  - dmix 8y ago
    Yep Apparently the main problem seems to be the fact there is a single point of failure (a single AoA sensor) and it could be resolved by having multiple sensors. Not that some sort of new automation is occurring than before.
    - ggreer 8y ago
      The 737 max has multiple AoA sensors. Having multiple sensors doesn't always help, as failures are correlated. For example, there was an Airbus A321 that had 2 of its 3 sensors get stuck in the same position due to icing.[1] The computer thought that the one working sensor was malfunctioning and disregarded it. It then engaged stall protection, dipping the nose and causing the plane to dive at 4,000ft per minute. > The captain continued to hold “more than 50%” rearward stick in stable flight for a period, but with help from technicians on the ground, the crew was able to reconfigure the automation into the aircraft’s alternate control law, rather than its normal “direct” law. The action removed the alpha-protection checks and canceled the nose-down input. The aircraft then continued to its destination. These failure modes tend to happen more with Airbus planes because their flight control systems default to overriding human input if the computer deems it unsafe. Boeing's flight computers will give more resistance in the controls, but they mostly won't prevent the pilot from doing what they want to do. The exceptions (such as auto-trim and stall prevention) can be disabled with by flipping a couple of switches. 1. https://aviationweek.com/commercial-aviation/german-investigators-cast-wider-net-frozen-aoa-sensors-pamplona-dive-incident https://aviationweek.com/commercial-aviation/german-investig...
      - dmix 8y ago
        True but 2/3 failing instead of 1/1 is still the better option. I’ve read the Max only used one sensor for the MCAS system. But I’m not an expert on the subject so I’ll defer to the reports and more knowedgable people.
baybal2 8y ago
In human language: the centre of thrust of 737 MAX is placed such way that it is possible thrust pitch it into stall if the pilot completely misses that, or, on the opposite, if he overreacts and runs into oscillation. I think that all what MCAS does could've been achieved by telling pilots to set certain trim at the takeoff, when the thrust is maximal, and let the regular "hard" anti-stall system handle that in level flight. Again, software people trying to "think" for their users.
- deleted 8y ago
  [deleted]
aphextron 8y ago
>"Software combined with sensors would ensure the airplane would not tilt upward at an unsafe rate. The combination of the two would keep the nose at the precise right angle during all aspects of flight to prevent a potential stall. This immediately struck me as completely negligent insanity. The thought of flying on a commercial airliner with no inherent stability, akin to a fighter jet, is horrifying to me. How this got past regulators is just mindblowing.
- twtw 8y ago
  This is a seriously misleading characterization of the 737 Max. If you read https://theaircurrent.com/aviation-safety/what-is-the-boeing-737-max-maneuvering-characteristics-augmentation-system-mcas-jt610/ https://theaircurrent.com/aviation-safety/what-is-the-boeing... (the source of the article that 'acqq is selectively quoting) you will learn the following: > MCAS is “activated without pilot input” and “commands nose down stabilizer to enhance pitch characteristics during step turns with elevated load factors and during flaps up flight at airspeeds approaching stall. > Since it operates in situations where the aircraft is under relatively high g load and near stall, a pilot should never see the operation of MCAS. In other words, the aircraft does not need MCAS for stability during flight in anything but exceptional circumstances. Normal flights should never have MCAS active. This is not remotely similar to the aerodynamics of a fighter jet. MCAS is a software mechanism designed to prevent stalls in extreme circumstances that can be overridden with the same method used to disable auto trim on previous models of the 737. The A320 has software to prevent phugiod motion in exceptional scenarios, except the A320's mechanism cannot be overridden by the pilot. I don't care if you choose to never fly on a plane again, but don't spread this misinformed hysteria.
  - tigershark 8y ago
    I think that the advice that you just gave to the parent post to not spread misinformation should be applied to your post. In the previous model it was perfectly fine to just tilt up to override that system. We have the sad proof that in the new model it is not enough given that the lion air pilots tried to do it for 26 times in 13 minutes. In a 2 months old plane. Given that 300 people already lost their life I will avoid flying on this plane and I’ll urge everyone to avoid it. If you are really keen to fly on it then please be my guest, but don’t you dare spread misinformation saying that this plane is perfectly safe and the accidents happened only because of the pilots or of the airline maintenance. I’m really wondering what are your vested interests in Boeing since you are polluting this thread with lies trying to cancel any Boeing responsibilities.
Gibbon1 8y ago
This reminds me of a link to a talk by Nancy Leveson that a guy linked to while taking Uncle Bob behind the woodshed for a shellacking because of some ignorant things he said about software safety. https://www.youtube.com/watch?v=WBktiCyPLo4 https://www.youtube.com/watch?v=WBktiCyPLo4 If you don't want to watch an hour long video, she says most serious accidents and near misses happen not because something failed (and lets face it software 'bugs' are just another type of failure). But because bad interactions between properly functioning systems[1]. One of her comments is you need a system that watches for stuff like that. Lion Air Flight 610 crash happened because there wasn't a system that could make a determination that the pilots needed hard control over the aircraft. A safety system being repeatably overridden by the pilots for 11 minutes should have resulted in that system being shut down. [1] One thing I got beat into me over the last 20 years developing sensor networks is how little information is actually available to systems like a MCAS system. That makes it's reasoning about the world brittle. Humans are better at managing path dependent state based on inane sources of information. The pilots utterly knew the aircraft wasn't stalling just by feel. While the MCAS 'knew' it was based on a messed up sensor.
- Yetanfou 8y ago
  > The pilots utterly knew the aircraft wasn't stalling just by feel. While the MCAS 'knew' it was based on a messed up sensor. ...except when the pilots get it wrong like they did on AF447 which crashed into the Atlantic Ocean when 'the crew failed to recognize the aircraft had stalled and consequently did not make inputs that would have made it possible to recover from the stall.' [1]. That accident was caused by a combination of equipment failure - iced up Pitot tubes - in combination with an erroneous reaction by the pilots. [1] https://en.wikipedia.org/wiki/Air_France_Flight_447 https://en.wikipedia.org/wiki/Air_France_Flight_447
  - Gibbon1 8y ago
    AF447 crashed because the auto pilot handed control of the airplane over to the pilots when it was in the coffin corner with iced over pitot tubes[1]. And then stall warning system gave them very confusing information. It's not really the same situation. In one the aircraft was absolutely flyable without instruments. The other it was not flyable without instruments. [1] Absolutely last thing you want in that situation.

by acqq 8y ago

youngtaff 8y ago

This is so important… most airlines are inherently stable by design but the 737 Max requires software to be stable

twtw 8y ago
No, it doesn't. The 737 max has software to prevent stalls in situations outside of the profile of normal flight. As does e.g. the A320.
- dmix 8y ago
  Yep Apparently the main problem seems to be the fact there is a single point of failure (a single AoA sensor) and it could be resolved by having multiple sensors. Not that some sort of new automation is occurring than before.
  - ggreer 8y ago
    The 737 max has multiple AoA sensors. Having multiple sensors doesn't always help, as failures are correlated. For example, there was an Airbus A321 that had 2 of its 3 sensors get stuck in the same position due to icing.[1] The computer thought that the one working sensor was malfunctioning and disregarded it. It then engaged stall protection, dipping the nose and causing the plane to dive at 4,000ft per minute. > The captain continued to hold “more than 50%” rearward stick in stable flight for a period, but with help from technicians on the ground, the crew was able to reconfigure the automation into the aircraft’s alternate control law, rather than its normal “direct” law. The action removed the alpha-protection checks and canceled the nose-down input. The aircraft then continued to its destination. These failure modes tend to happen more with Airbus planes because their flight control systems default to overriding human input if the computer deems it unsafe. Boeing's flight computers will give more resistance in the controls, but they mostly won't prevent the pilot from doing what they want to do. The exceptions (such as auto-trim and stall prevention) can be disabled with by flipping a couple of switches. 1. https://aviationweek.com/commercial-aviation/german-investigators-cast-wider-net-frozen-aoa-sensors-pamplona-dive-incident https://aviationweek.com/commercial-aviation/german-investig...
    - dmix 8y ago
      True but 2/3 failing instead of 1/1 is still the better option. I’ve read the Max only used one sensor for the MCAS system. But I’m not an expert on the subject so I’ll defer to the reports and more knowedgable people.

baybal2 8y ago

In human language: the centre of thrust of 737 MAX is placed such way that it is possible thrust pitch it into stall if the pilot completely misses that, or, on the opposite, if he overreacts and runs into oscillation. I think that all what MCAS does could've been achieved by telling pilots to set certain trim at the takeoff, when the thrust is maximal, and let the regular "hard" anti-stall system handle that in level flight. Again, software people trying to "think" for their users.

deleted 8y ago
[deleted]

aphextron 8y ago

>"Software combined with sensors would ensure the airplane would not tilt upward at an unsafe rate. The combination of the two would keep the nose at the precise right angle during all aspects of flight to prevent a potential stall. This immediately struck me as completely negligent insanity. The thought of flying on a commercial airliner with no inherent stability, akin to a fighter jet, is horrifying to me. How this got past regulators is just mindblowing.

twtw 8y ago
This is a seriously misleading characterization of the 737 Max. If you read https://theaircurrent.com/aviation-safety/what-is-the-boeing-737-max-maneuvering-characteristics-augmentation-system-mcas-jt610/ https://theaircurrent.com/aviation-safety/what-is-the-boeing... (the source of the article that 'acqq is selectively quoting) you will learn the following: > MCAS is “activated without pilot input” and “commands nose down stabilizer to enhance pitch characteristics during step turns with elevated load factors and during flaps up flight at airspeeds approaching stall. > Since it operates in situations where the aircraft is under relatively high g load and near stall, a pilot should never see the operation of MCAS. In other words, the aircraft does not need MCAS for stability during flight in anything but exceptional circumstances. Normal flights should never have MCAS active. This is not remotely similar to the aerodynamics of a fighter jet. MCAS is a software mechanism designed to prevent stalls in extreme circumstances that can be overridden with the same method used to disable auto trim on previous models of the 737. The A320 has software to prevent phugiod motion in exceptional scenarios, except the A320's mechanism cannot be overridden by the pilot. I don't care if you choose to never fly on a plane again, but don't spread this misinformed hysteria.
- tigershark 8y ago
  I think that the advice that you just gave to the parent post to not spread misinformation should be applied to your post. In the previous model it was perfectly fine to just tilt up to override that system. We have the sad proof that in the new model it is not enough given that the lion air pilots tried to do it for 26 times in 13 minutes. In a 2 months old plane. Given that 300 people already lost their life I will avoid flying on this plane and I’ll urge everyone to avoid it. If you are really keen to fly on it then please be my guest, but don’t you dare spread misinformation saying that this plane is perfectly safe and the accidents happened only because of the pilots or of the airline maintenance. I’m really wondering what are your vested interests in Boeing since you are polluting this thread with lies trying to cancel any Boeing responsibilities.

Gibbon1 8y ago

This reminds me of a link to a talk by Nancy Leveson that a guy linked to while taking Uncle Bob behind the woodshed for a shellacking because of some ignorant things he said about software safety. https://www.youtube.com/watch?v=WBktiCyPLo4 https://www.youtube.com/watch?v=WBktiCyPLo4 If you don't want to watch an hour long video, she says most serious accidents and near misses happen not because something failed (and lets face it software 'bugs' are just another type of failure). But because bad interactions between properly functioning systems[1]. One of her comments is you need a system that watches for stuff like that. Lion Air Flight 610 crash happened because there wasn't a system that could make a determination that the pilots needed hard control over the aircraft. A safety system being repeatably overridden by the pilots for 11 minutes should have resulted in that system being shut down. [1] One thing I got beat into me over the last 20 years developing sensor networks is how little information is actually available to systems like a MCAS system. That makes it's reasoning about the world brittle. Humans are better at managing path dependent state based on inane sources of information. The pilots utterly knew the aircraft wasn't stalling just by feel. While the MCAS 'knew' it was based on a messed up sensor.

Yetanfou 8y ago
> The pilots utterly knew the aircraft wasn't stalling just by feel. While the MCAS 'knew' it was based on a messed up sensor. ...except when the pilots get it wrong like they did on AF447 which crashed into the Atlantic Ocean when 'the crew failed to recognize the aircraft had stalled and consequently did not make inputs that would have made it possible to recover from the stall.' [1]. That accident was caused by a combination of equipment failure - iced up Pitot tubes - in combination with an erroneous reaction by the pilots. [1] https://en.wikipedia.org/wiki/Air_France_Flight_447 https://en.wikipedia.org/wiki/Air_France_Flight_447
- Gibbon1 8y ago
  AF447 crashed because the auto pilot handed control of the airplane over to the pilots when it was in the coffin corner with iced over pitot tubes[1]. And then stall warning system gave them very confusing information. It's not really the same situation. In one the aircraft was absolutely flyable without instruments. The other it was not flyable without instruments. [1] Absolutely last thing you want in that situation.