11 ms·

I'm struck by the connection between this and the Air France Airbus 332 which crashed en route from South America to France about a decade ago. It seems that t

I'm struck by the connection between this and the Air France Airbus 332 which crashed en route from South America to France about a decade ago. It seems that the 737MAX (at least, the one last year -- we don't know about the latest one yet) crashed because a faulty sensor caused the computer to automatically point the nose down in order to avoid a perceived stall risk and the pilots weren't able (or didn't know how) to disable that. In contrast, the 332 crashed because a faulty sensor misled the flight crew into pointing the nose up and getting into a stall. In both cases, crashes resulted from reliance on a faulty sensor -- but in one case it was flight crew and in the other case it was software. Solving this isn't going to be as simple as saying "the flight software should defer to the pilot" or vice versa.

xeromal 8y ago
Really, flying by instrumentation is what you're saying is the problem and that's the truth. There's no way around that though. I did read that the sensor for the MAX is on both sides but is only activated on the side of who is flying, the pilot or the co-pilot. If the sensor fails, the plane fails. They could at least have both sensors active as a failsafe in case one is acting up.
- cperciva 8y ago
  I don't think it's quite that simple. In the case of the Lion Air flight, one of the AoA sensors had been recently replaced due to problems on an earlier flight; in the case of the Air France flight, there were icing conditions which were known to affect the airspeed sensors. It's possible that both of those flights could have been saved given better awareness of how much those sensors could be trusted at the time -- for example, if Lion Air's engineers, upon fiddling with AoA sensors, had been able to tell the avionics systems "the AoA sensors might be unreliable; don't do anything automatically based on those sensors which might crash the plane".
  - laydn 8y ago
    It is difficult to understand the design decisions made on these complex software systems without any real domain knowledge, but one can't help but wonder whether this whole MCAS system is pushed into the field prematurely. For example, we know that the flight control computer has access to altitude information. Why would it let the MCAS push the nose down, when it knows that you have very little altitude margin? (I am talking about the Lion Air flight).
    - sokoloff 8y ago
      Preventing a stall at low altitudes is arguably more important than preventing one at high altitudes. The MCAS is a compensation for extra powerful engines. Those engines are most powerful at low altitudes as well.
      - laydn 8y ago
        That is correct, but remember that the aircraft wasn't stalling, the AoA sensor was bad.
  - xeromal 8y ago
    I think the problem is that this whole automatic system is to prevent crashes because the engines change how the plane behaves compared to a normal 737 which is the training Boing was trying to avoid in the first place. So for them to turn off the automatic system, they really need to be training on how to fly this variant of the 737.
- Johnny555 8y ago
  If the sensor fails, the plane fails I don't believe that's true - if the sensor gives an erroneous reading, it's up to the pilot to recognize uncommanded trim and disable it by shutting off power to the system that moves the stabilizer. Really, flying by instrumentation is what you're saying is the problem and that's the truth Flying by faulty instruments is clearly bad, but flying by (working) instruments is much better than the alternative, every pilot going through instrument training learns very quickly that he needs to trust the instruments when flying in poor visibility, his senses don't work. They could at least have both sensors active as a failsafe in case one is acting up If you have two sensors and one is acting up, how do you know which one is true and which one is false?
  - yetihehe 8y ago
    > If you have two sensors and one is acting up, how do you know which one is true and which one is false? Typically it is possible to determine this by looking at reading stability. If one sensor is constantly stuck or changes values too fast (0-100% several times per second) or too slow, you know it's faulty. Those sensors should be engineered so that you can know if it's faulty. If you can't detect faulty sensor, it's just bad engineering.
    - Johnny555 8y ago
      If you have 2 sensors, how do you reliably detect that one of them is bent or installed incorrectly and gives an inaccurate, but stable, reading? If the sensor is completely malfunctioning it's easier to detect, but what about when it's just wrong?
      - yetihehe 8y ago
        > how do you reliably detect that one of them is bent or installed incorrectly During standard pre-launch or manufacturing tests. It should be verified by applying some change and checking that this change is measured correctly. Generally for critical sensors, you can add some circuitry or even mechanical means of checking (eg heater on temperature sensor). If mechanical side fails, whole sensor module is marked as failed. Critical sensors should be designed in a way that you know when it fails.
- epse 8y ago
  Usually, with things like airspeed indicators for example, there are two sensors, one on each side which get activated depending on who is flying, like you said. However with airspeed for example they are supposed to monitor the difference in reading and if one sensor goes faulty the system should switch over. Why that doesn't happen with these sensors I have no clue
namirez 8y ago
They were different sensors though. In Air France 333, the pitot static tube, which measure airspeed, was jammed by ice. In Lion Air 610, the Alpha vane, which measure angle of attach, was faulty. But I agree that the solution is not as simple as pilot vs. software. At the end of the day, these sensors and computers need extra redundancies.
- cperciva 8y ago
  Different sensors, yes. But similar issues -- in one case the pilot stalled the plane, and in the other case software designed to prevent a stall caused an unrecoverable dive.
- PakG1 8y ago
  If redundant sensors contradict each other, what should the pilot do next? That's not easy to figure out. Even if you had say 10 redundant sensors, and 1 doesn't agree with the other 9, is there cause for concern or no? And I'm not sure they'd install 10 sensors either, eventually you'll also get information overload for the pilot.
  - ei8htyfi5e 8y ago
    That's generally not how redundant systems work. They'll usually implement some form of a Kalman filter or whatever cool kids use these days to filter out bad readings, while alerting the pilot that one of the sensors seems to be faulty. Usually things that can kill people are triple redundant, where one goes bad, you can trust the other two readings for this reason. I'm surprised there is a single point of failure like this in the design. But after I've read a bit about how Boeing released this product, maybe I'm not surprised.
    - dbdjfjrjvebd 8y ago
      The doesn't account for a systematic failure. It doesn't matter if you have 1000 sensors if they all fail at the same time.
      - 8y ago
js2 8y ago
I think you’re slightly mischaracterizing the cause in the AF447 flight in that there was a lot more going on than just the airspeed indicator: AF447 crashed because of a cyclical series of erroneous inputs based on unreliable prompts from aircraft systems; a cycle that fed on itself to the extent that control was never regained. The BEA’s final report attributes multiple factors to the AF447 mishap: temporary and repeated inconsistencies and loss of airspeed indication; inappropriate control inputs; failure to identify unreliable indicated speed; the approach to stall; the full stall state; and the inability to apply an appropriate response in these flight regimes. https://sma.nasa.gov/docs/default-source/safety-messages/safetymessage-2012-07-31-lossairfranceflight447.pdf?sfvrsn=e3ae1ef8_4 https://sma.nasa.gov/docs/default-source/safety-messages/saf... Also, in the AF447 case the computer had to defer to the human because it didn’t know what the air speed was. In contrast, one thing that’s surprising to me in Lion case is that the MCAS seemed to be willing to trust a faulty AoA sensor: The DFDR recorded a difference between left and right Angle of Attack (AoA) of about 20° and continued until the end of recording. http://avherald.com/h?article=4bf90724/0009&opt=0 http://avherald.com/h?article=4bf90724/0009&opt=0 So it’s got a pair of AoA sensors that aren’t in agreement (split brain, as it were) and it’s going to command nose down anyway? (I’m sure there’s a reason there aren’t triple redundant sensors where two have to agree or some such. I think the flight computer does require the various different kinds of sensors to agree, but I don’t think there’s triple redundancy of each sensor.) (Edit: sorry folks, I edited this a bunch of times so the replies below may not make perfect sense. I should really start typing my replies offline.)
- cperciva 8y ago
  Air France 447 was an Airbus 330. I think 333 is a typo. It was a typo, but for "332" (which is the jargon for "330-200").
  - raverbashing 8y ago
    Yes, it's the ICAO aircraft type: A332 https://en.wikipedia.org/wiki/List_of_ICAO_aircraft_type_designators https://en.wikipedia.org/wiki/List_of_ICAO_aircraft_type_des...
- 8y ago
jayalpha 8y ago
"Solving this isn't going to be as simple as saying "the flight software should defer to the pilot" or vice versa." Actually it is. 2 sensors: Defer to the pilot with alarm that sensor data is unreliable if inconsistent. 3 sensors: trust majority of signals. But "deciding" by software for one signal when having only 2 sensors with inconsistent results is negligence. https://en.wikipedia.org/wiki/Air_France_Flight_447#Airspeed_inconsistency https://en.wikipedia.org/wiki/Air_France_Flight_447#Airspeed...
- usrusr 8y ago
  The root cause is that they were trying to work around a hardware problem with a software patch. In the old days, they would have balanced the incidental high-aoa lift from the moved and bigger nacelles with a larger elevator surface instead of adding a jack-in-the-box surprise feature into already borderline incomprehensible autotrim logic.
OscarTheGrinch 8y ago
It sounds like no one system of keeping the plane level is ever going to be fool & error proof. OK, this might be a stupid idea, but what about a simple old spirit level, a fancy oil based one that will never freeze, mounted to the side of the cockpit to give the pilots a emergency true level backup when all else fails?
- codeduck 8y ago
  A spirit level does not work in an accelerating frame of reference. From the point of view of a spirit level, there is no difference between straight and level flight (1g due to earth's gravity) or a spiral dive (>1g due to a spiraling turn downwards). Gyroscopes work, which is why artificial horizons are a thing. But an artificial horizon doesn't show anything except where your nose is pointing. You need all sorts of other sensors to tell you which direction you are actually going.
  - OscarTheGrinch 8y ago
    OK, thanks for the succinct explanation. Its nice to know that people smarter than me are trying to solve this.
    - codeduck 8y ago
      Not smarter, just an aviation layman geek :)
- hevi_jos 8y ago
  A spirit level does not tell you anything. The had existed in planes almost since planes exist. You can not differentiate a force coming from plane acceleration and deceleration from gravity(which also comes from some kind of apparent deceleration). People in the space Station are being affected almost with the same gravity that you or me. In fact, a spirit level or your ears provide you with wrong information all the time with no visibility. With planes, the first thing you have to learn is not trusting your senses.
cedivad 8y ago
As a non pilot, AF447 crashed because the guy flying it kept pitching up during the entire duration of the stall, 30k feet. The captain finally realised what was going on just a few thousands feet off the ground and starts yelling the pilot flying to pitch down, and he has to repeat the command several times because the guy just isn't listening. Honestly it's just sad. 200 people killed because of an idiot. The same captain says "angle of attack 10 degrees" just a second before impact. The same pilot flying suggests to deploy airbreaks because he felt like the plane was going too slowly - during a stall. I mean it hurts to even think about this.
- refurb 8y ago
  As a non-pilot as well, it is a crazy situation. My understanding is when you can’t trust your instruments, you set a certain level of power and pitch and you’ll know you’ll be ok. The plane will keep flying. This guy is pulling back hard on the stick the entire time. I don’t think many pilots would ever think “this is the appropriate thing to do in this situation.”
  - iSnow 8y ago
    That's what panic and confusion does: you stop thinking and cling to reflexes.
StreamBright 8y ago
In the 737MAX case, there is no human interaction needed for the crash.
willyt 8y ago
Yes but AF447 was caused by the pilot flying forgetting the basic rule of fly the correct "pitch and power" when you lose situational awareness. If he had left the controls alone nothing would have happened and the errors would have cleared when the sensors defrosted. The problem was further compounded because he took back control from the co-pilot, who was correcting the situation, without asking and reapplied the incorrect inputs. By the time the plane was going at 60kts IAS at cruise altitude it was so far out of the normal flight envelope that the computers started sounding erroneous stall warnings as the plane speeded up again and it wasn't until the captain came onto the flight deck that the situation was understood fully and by then it was too late. Whereas in this case an undocumented system causes the plane to seemingly automatically and repeatedly attempt to fly into the ground if there is a sensor malfunction. The pilot has a short window of time, I don't know like 30-90secs?, to figure out what is going on and switch off some specific obscure switches to disable the malfunctioning system and then wind the trim back manually before the plane becomes uncontrollable.
jrockway 8y ago
AF447, I think, was just a bunch of UI errors that led to the deaths of hundreds. As I understand it, after one airspeed sensor failed, the plane switched from "normal law" to "alternate law". In "normal law", there is no control input that can take the plane out of its safe flight envelope (i.e., you can pull all the way back at the lowest possible airspeed and not stall the plane). In "alternate law" there is no such protection. When AF447 crashed, the first officer spent most of the time pulling all the way back on the joystick, which will (and did) stall the plane. This, to me, indicates that he didn't have any idea that the plane had switched into alternate law, which seems like a UX error. I bet if all the screens switched from white-on-black to black-on-white when going into alternate law (or something more night-vision friendly) there would have been no doubt and there would have been no incident. The other problem was that the captain and first-officer were inputting conflicting control inputs and didn't know it. The plane just averages them, and provides no indication that it's doing so. The captain sees that he's pushing all the way forward on the joystick and has to wonder why the plane is still stalling. Meanwhile, on other planes the control columns are mechanically linked, so you have to fight against the force of the other pilot which will signal you to say something like "dude let go" and regain control over the plane. I feel like we should have fixed this in the 1980s when this happened: https://www.youtube.com/watch?v=-kHa3WNerjU https://www.youtube.com/watch?v=-kHa3WNerjU But here we are in 2019 with basically the same problem. I fear that Boeing hasn't learned Airbus's lessons and the 737 MAX is confusing people in the same way that people were confused by the first A320s. The solution has always been "blame the pilot" but I blame the software.
- foldr 8y ago
  >I bet if all the screens switched from white-on-black to black-on-white when going into alternate law (or something more night-vision friendly) there would have been no doubt and there would have been no incident. You're talking about two pilots who couldn't figure out that the plane was stalled even though it was descending rapidly with a nose up attitude. There's not much that UX can do to compensate for that level of incompetence. Holding the stick back in that situation would never be appropriate, regardless of which control law applied. >The other problem was that the captain and first-officer were inputting conflicting control inputs and didn't know it. This is a persistent myth about this accident. See e.g. the following post: http://www.airliners.net/forum/viewtopic.php?t=772033&start=50#p11139241 http://www.airliners.net/forum/viewtopic.php?t=772033&start=...
sjg007 8y ago
I don't understand why they don't have multiple redundant sensors or multiple technologies that detect the same thing.

xeromal 8y ago

Really, flying by instrumentation is what you're saying is the problem and that's the truth. There's no way around that though. I did read that the sensor for the MAX is on both sides but is only activated on the side of who is flying, the pilot or the co-pilot. If the sensor fails, the plane fails. They could at least have both sensors active as a failsafe in case one is acting up.

cperciva 8y ago
I don't think it's quite that simple. In the case of the Lion Air flight, one of the AoA sensors had been recently replaced due to problems on an earlier flight; in the case of the Air France flight, there were icing conditions which were known to affect the airspeed sensors. It's possible that both of those flights could have been saved given better awareness of how much those sensors could be trusted at the time -- for example, if Lion Air's engineers, upon fiddling with AoA sensors, had been able to tell the avionics systems "the AoA sensors might be unreliable; don't do anything automatically based on those sensors which might crash the plane".
- laydn 8y ago
  It is difficult to understand the design decisions made on these complex software systems without any real domain knowledge, but one can't help but wonder whether this whole MCAS system is pushed into the field prematurely. For example, we know that the flight control computer has access to altitude information. Why would it let the MCAS push the nose down, when it knows that you have very little altitude margin? (I am talking about the Lion Air flight).
  - sokoloff 8y ago
    Preventing a stall at low altitudes is arguably more important than preventing one at high altitudes. The MCAS is a compensation for extra powerful engines. Those engines are most powerful at low altitudes as well.
    - laydn 8y ago
      That is correct, but remember that the aircraft wasn't stalling, the AoA sensor was bad.
- xeromal 8y ago
  I think the problem is that this whole automatic system is to prevent crashes because the engines change how the plane behaves compared to a normal 737 which is the training Boing was trying to avoid in the first place. So for them to turn off the automatic system, they really need to be training on how to fly this variant of the 737.
Johnny555 8y ago
If the sensor fails, the plane fails I don't believe that's true - if the sensor gives an erroneous reading, it's up to the pilot to recognize uncommanded trim and disable it by shutting off power to the system that moves the stabilizer. Really, flying by instrumentation is what you're saying is the problem and that's the truth Flying by faulty instruments is clearly bad, but flying by (working) instruments is much better than the alternative, every pilot going through instrument training learns very quickly that he needs to trust the instruments when flying in poor visibility, his senses don't work. They could at least have both sensors active as a failsafe in case one is acting up If you have two sensors and one is acting up, how do you know which one is true and which one is false?
- yetihehe 8y ago
  > If you have two sensors and one is acting up, how do you know which one is true and which one is false? Typically it is possible to determine this by looking at reading stability. If one sensor is constantly stuck or changes values too fast (0-100% several times per second) or too slow, you know it's faulty. Those sensors should be engineered so that you can know if it's faulty. If you can't detect faulty sensor, it's just bad engineering.
  - Johnny555 8y ago
    If you have 2 sensors, how do you reliably detect that one of them is bent or installed incorrectly and gives an inaccurate, but stable, reading? If the sensor is completely malfunctioning it's easier to detect, but what about when it's just wrong?
    - yetihehe 8y ago
      > how do you reliably detect that one of them is bent or installed incorrectly During standard pre-launch or manufacturing tests. It should be verified by applying some change and checking that this change is measured correctly. Generally for critical sensors, you can add some circuitry or even mechanical means of checking (eg heater on temperature sensor). If mechanical side fails, whole sensor module is marked as failed. Critical sensors should be designed in a way that you know when it fails.
epse 8y ago
Usually, with things like airspeed indicators for example, there are two sensors, one on each side which get activated depending on who is flying, like you said. However with airspeed for example they are supposed to monitor the difference in reading and if one sensor goes faulty the system should switch over. Why that doesn't happen with these sensors I have no clue

namirez 8y ago

They were different sensors though. In Air France 333, the pitot static tube, which measure airspeed, was jammed by ice. In Lion Air 610, the Alpha vane, which measure angle of attach, was faulty. But I agree that the solution is not as simple as pilot vs. software. At the end of the day, these sensors and computers need extra redundancies.

cperciva 8y ago
Different sensors, yes. But similar issues -- in one case the pilot stalled the plane, and in the other case software designed to prevent a stall caused an unrecoverable dive.
PakG1 8y ago
If redundant sensors contradict each other, what should the pilot do next? That's not easy to figure out. Even if you had say 10 redundant sensors, and 1 doesn't agree with the other 9, is there cause for concern or no? And I'm not sure they'd install 10 sensors either, eventually you'll also get information overload for the pilot.
- ei8htyfi5e 8y ago
  That's generally not how redundant systems work. They'll usually implement some form of a Kalman filter or whatever cool kids use these days to filter out bad readings, while alerting the pilot that one of the sensors seems to be faulty. Usually things that can kill people are triple redundant, where one goes bad, you can trust the other two readings for this reason. I'm surprised there is a single point of failure like this in the design. But after I've read a bit about how Boeing released this product, maybe I'm not surprised.
  - dbdjfjrjvebd 8y ago
    The doesn't account for a systematic failure. It doesn't matter if you have 1000 sensors if they all fail at the same time.
    - 8y ago

js2 8y ago

I think you’re slightly mischaracterizing the cause in the AF447 flight in that there was a lot more going on than just the airspeed indicator: AF447 crashed because of a cyclical series of erroneous inputs based on unreliable prompts from aircraft systems; a cycle that fed on itself to the extent that control was never regained. The BEA’s final report attributes multiple factors to the AF447 mishap: temporary and repeated inconsistencies and loss of airspeed indication; inappropriate control inputs; failure to identify unreliable indicated speed; the approach to stall; the full stall state; and the inability to apply an appropriate response in these flight regimes. https://sma.nasa.gov/docs/default-source/safety-messages/safetymessage-2012-07-31-lossairfranceflight447.pdf?sfvrsn=e3ae1ef8_4 https://sma.nasa.gov/docs/default-source/safety-messages/saf... Also, in the AF447 case the computer had to defer to the human because it didn’t know what the air speed was. In contrast, one thing that’s surprising to me in Lion case is that the MCAS seemed to be willing to trust a faulty AoA sensor: The DFDR recorded a difference between left and right Angle of Attack (AoA) of about 20° and continued until the end of recording. http://avherald.com/h?article=4bf90724/0009&opt=0 http://avherald.com/h?article=4bf90724/0009&opt=0 So it’s got a pair of AoA sensors that aren’t in agreement (split brain, as it were) and it’s going to command nose down anyway? (I’m sure there’s a reason there aren’t triple redundant sensors where two have to agree or some such. I think the flight computer does require the various different kinds of sensors to agree, but I don’t think there’s triple redundancy of each sensor.) (Edit: sorry folks, I edited this a bunch of times so the replies below may not make perfect sense. I should really start typing my replies offline.)

cperciva 8y ago
Air France 447 was an Airbus 330. I think 333 is a typo. It was a typo, but for "332" (which is the jargon for "330-200").
- raverbashing 8y ago
  Yes, it's the ICAO aircraft type: A332 https://en.wikipedia.org/wiki/List_of_ICAO_aircraft_type_designators https://en.wikipedia.org/wiki/List_of_ICAO_aircraft_type_des...
8y ago

jayalpha 8y ago

"Solving this isn't going to be as simple as saying "the flight software should defer to the pilot" or vice versa." Actually it is. 2 sensors: Defer to the pilot with alarm that sensor data is unreliable if inconsistent. 3 sensors: trust majority of signals. But "deciding" by software for one signal when having only 2 sensors with inconsistent results is negligence. https://en.wikipedia.org/wiki/Air_France_Flight_447#Airspeed_inconsistency https://en.wikipedia.org/wiki/Air_France_Flight_447#Airspeed...

usrusr 8y ago
The root cause is that they were trying to work around a hardware problem with a software patch. In the old days, they would have balanced the incidental high-aoa lift from the moved and bigger nacelles with a larger elevator surface instead of adding a jack-in-the-box surprise feature into already borderline incomprehensible autotrim logic.

OscarTheGrinch 8y ago

It sounds like no one system of keeping the plane level is ever going to be fool & error proof. OK, this might be a stupid idea, but what about a simple old spirit level, a fancy oil based one that will never freeze, mounted to the side of the cockpit to give the pilots a emergency true level backup when all else fails?

codeduck 8y ago
A spirit level does not work in an accelerating frame of reference. From the point of view of a spirit level, there is no difference between straight and level flight (1g due to earth's gravity) or a spiral dive (>1g due to a spiraling turn downwards). Gyroscopes work, which is why artificial horizons are a thing. But an artificial horizon doesn't show anything except where your nose is pointing. You need all sorts of other sensors to tell you which direction you are actually going.
- OscarTheGrinch 8y ago
  OK, thanks for the succinct explanation. Its nice to know that people smarter than me are trying to solve this.
  - codeduck 8y ago
    Not smarter, just an aviation layman geek :)
hevi_jos 8y ago
A spirit level does not tell you anything. The had existed in planes almost since planes exist. You can not differentiate a force coming from plane acceleration and deceleration from gravity(which also comes from some kind of apparent deceleration). People in the space Station are being affected almost with the same gravity that you or me. In fact, a spirit level or your ears provide you with wrong information all the time with no visibility. With planes, the first thing you have to learn is not trusting your senses.

cedivad 8y ago

As a non pilot, AF447 crashed because the guy flying it kept pitching up during the entire duration of the stall, 30k feet. The captain finally realised what was going on just a few thousands feet off the ground and starts yelling the pilot flying to pitch down, and he has to repeat the command several times because the guy just isn't listening. Honestly it's just sad. 200 people killed because of an idiot. The same captain says "angle of attack 10 degrees" just a second before impact. The same pilot flying suggests to deploy airbreaks because he felt like the plane was going too slowly - during a stall. I mean it hurts to even think about this.

refurb 8y ago
As a non-pilot as well, it is a crazy situation. My understanding is when you can’t trust your instruments, you set a certain level of power and pitch and you’ll know you’ll be ok. The plane will keep flying. This guy is pulling back hard on the stick the entire time. I don’t think many pilots would ever think “this is the appropriate thing to do in this situation.”
- iSnow 8y ago
  That's what panic and confusion does: you stop thinking and cling to reflexes.

StreamBright 8y ago

In the 737MAX case, there is no human interaction needed for the crash.

willyt 8y ago

Yes but AF447 was caused by the pilot flying forgetting the basic rule of fly the correct "pitch and power" when you lose situational awareness. If he had left the controls alone nothing would have happened and the errors would have cleared when the sensors defrosted. The problem was further compounded because he took back control from the co-pilot, who was correcting the situation, without asking and reapplied the incorrect inputs. By the time the plane was going at 60kts IAS at cruise altitude it was so far out of the normal flight envelope that the computers started sounding erroneous stall warnings as the plane speeded up again and it wasn't until the captain came onto the flight deck that the situation was understood fully and by then it was too late. Whereas in this case an undocumented system causes the plane to seemingly automatically and repeatedly attempt to fly into the ground if there is a sensor malfunction. The pilot has a short window of time, I don't know like 30-90secs?, to figure out what is going on and switch off some specific obscure switches to disable the malfunctioning system and then wind the trim back manually before the plane becomes uncontrollable.

jrockway 8y ago

AF447, I think, was just a bunch of UI errors that led to the deaths of hundreds. As I understand it, after one airspeed sensor failed, the plane switched from "normal law" to "alternate law". In "normal law", there is no control input that can take the plane out of its safe flight envelope (i.e., you can pull all the way back at the lowest possible airspeed and not stall the plane). In "alternate law" there is no such protection. When AF447 crashed, the first officer spent most of the time pulling all the way back on the joystick, which will (and did) stall the plane. This, to me, indicates that he didn't have any idea that the plane had switched into alternate law, which seems like a UX error. I bet if all the screens switched from white-on-black to black-on-white when going into alternate law (or something more night-vision friendly) there would have been no doubt and there would have been no incident. The other problem was that the captain and first-officer were inputting conflicting control inputs and didn't know it. The plane just averages them, and provides no indication that it's doing so. The captain sees that he's pushing all the way forward on the joystick and has to wonder why the plane is still stalling. Meanwhile, on other planes the control columns are mechanically linked, so you have to fight against the force of the other pilot which will signal you to say something like "dude let go" and regain control over the plane. I feel like we should have fixed this in the 1980s when this happened: https://www.youtube.com/watch?v=-kHa3WNerjU https://www.youtube.com/watch?v=-kHa3WNerjU But here we are in 2019 with basically the same problem. I fear that Boeing hasn't learned Airbus's lessons and the 737 MAX is confusing people in the same way that people were confused by the first A320s. The solution has always been "blame the pilot" but I blame the software.

foldr 8y ago
>I bet if all the screens switched from white-on-black to black-on-white when going into alternate law (or something more night-vision friendly) there would have been no doubt and there would have been no incident. You're talking about two pilots who couldn't figure out that the plane was stalled even though it was descending rapidly with a nose up attitude. There's not much that UX can do to compensate for that level of incompetence. Holding the stick back in that situation would never be appropriate, regardless of which control law applied. >The other problem was that the captain and first-officer were inputting conflicting control inputs and didn't know it. This is a persistent myth about this accident. See e.g. the following post: http://www.airliners.net/forum/viewtopic.php?t=772033&start=50#p11139241 http://www.airliners.net/forum/viewtopic.php?t=772033&start=...

sjg007 8y ago

I don't understand why they don't have multiple redundant sensors or multiple technologies that detect the same thing.