4 ms·

Even if training would have prevented the crashes it's still bad design for a critical change in flight control. Computers should never overrule manual control

by briatx 8y ago

Even if training would have prevented the crashes it's still bad design for a critical change in flight control. Computers should never overrule manual controls. If the autopilot is on and the pilot makes an manual adjustment to the yoke, the autopilot shuts off. They should have designed the MCAS system to recognize when the pilot was fighting it and to disable itself. It's like the runaway Prius problem. Turning off the car might be considered an appropriate safety cutoff, but not everyone thinks of that in an emergent crisis.

Obi_Juan_Kenobi 8y ago
> Computers should never overrule manual controls. I think the justification for an AoA override is there; the system was created as a result of a history of pilot error. And having to disable a switch isn't overly burdensome. The issue seems to be transparency, letting the pilots know what the system is doing so they can make a judgement to disable it.
- CydeWeys 8y ago
  It also needs to use three separate AoA sensors so it can detect a single malfunctioning sensor and discard its input. A system so critical, that can point the nose down and potentially cause crashes, needs more hardware redundancy in its inputs.
losvedir 8y ago
> They should have designed the MCAS system to recognize when the pilot was fighting it and to disable itself. Well "fighting" sort of begs the question, but the MCAS system was by design supposed to only activate in tandem with a pilot's actions, so it can't really work like an autopilot. It supplied stabilizer trim while the pilot was controlling the plane in order to make the ascent feel the same as the older 737's, since the different engine position on the Max 8 would otherwise make it behave differently.
- briatx 8y ago
  > Well "fighting" sort of begs the question For instance, if the computer is attempting to pitch the plane down, while the pilot has the yoke all the way back. It should be possible to detect without too much mind reading.
  - nas 8y ago
    There is a large trim wheel (beside the pilot, about 10" in diameter) that the pilot can see turning if the system is automatically trimming. It is annoying how much speculation and misunderstanding is going on regarding that system. It might be a factor in the two crashed planes but we don't that yet.
- CydeWeys 8y ago
  It seems the issue is that the AoA indicator (no redundancies!) is less reliable than the actual human pilot, and thus should not be overriding the human pilot when the human thinks things are going normally (because they are) but the AoA sensor is going all funky.
deelowe 8y ago
> Computers should never overrule manual controls. The aoa system was put in place specifically to keep pilots from stalling planes. By design, it has to override manual controls. This is like saying ABS shouldn't override the brakes on a car.
- briatx 8y ago
  Well, how well does that work whenever the AoA sensors are faulty? All it really had to do was decrease the sensitivity of the controls not override it. Once the manual controls were pulled back all the way the computer should have disengaged. > This is like saying ABS shouldn't override the brakes on a car Remind me, does the ABS system make the car speed up?
  - y4mi 8y ago
    > Remind me, does the ABS system make the car speed up? Irrelevant. Cars don't crash on deacceleration . And ABS does override the controls - especially if the user just presses as hard as he can.
    - SomeHacker44 8y ago
      Take a hard, stable turn and tap the brakes. You will soon see that you are wrong. Heck, if you are at the limit of adhesion, even lifting a little off the gas will cause a novice to crash.
- outworlder 8y ago
  > The aoa system was put in place specifically to keep pilots from stalling planes. No, it was put in place to correct a hardware problem (engine nacelle changes) with a software fix. It's not an anti-stall mechanism per-se. In other words, it is not a stick pusher.
nutjob2 8y ago
"Computers should never overrule manual controls." You should probably avoid Airbuses in that case, since (the opposite of) that is a central design principle. And Airbus has arguably won the design wars, since Boeing is adopting their approach, just in a half-arsed and potentially dangerous way.
- nas 8y ago
  Yup. The question is not if computer automation can be made 100% reliable. Instead, can it be reliable enough such that there are fewer accidents vs manual controls? The answer seems to be yes. So the trend is to more computer automation, not less. I think people who think we can go back to fully manual controls are living in a fantasy.
cmurf 8y ago
>Computers should never overrule manual controls. I disagree. I've got all kinds of examples were on conventional cable/hydraulic control to control surface aircraft a pilot can overstress the airframe, break it, and crash. If a computer were to exactly know the normal flight envelope, and always proscribe inputs that lead to certain death? I'm all for that. And what does manual control even mean with fly-by-wire airplanes? >If the autopilot is on and the pilot makes an manual adjustment to the yoke, the autopilot shuts off. That isn't how it works since the simplest roll only autopilots appeared. It seems a reasonable argument that a single pilot should be able to overpower the autopilot long enough to disable it. >They should have designed the MCAS system to recognize when the pilot was fighting it and to disable itself. Unproven. Could be true or false. Boeing has a different design philosophy than Airbus whereby they include the pilot as integrated into system design, as the primary means of determining system failures. I have no inside information, however I can imagine that MCAS is intentionally designed to only accept one sensor input for two reasons: it's simpler, and you get a fast fail in the form of what appears to be runaway trim for which there is already a procedure to follow. I have two concerns with this though: a. The reported optional pay for (?) "aoa disagree" feature which does no decoupling of MCAS, but informs pilots when the alpha vanes disagree. I think that should be standard, not optional. b. MCAS silently disabling itself is potentially very dangerous even if the 737 MAX required a separate type rating, but it's possibly a great deal worse given that it does not require a separate type rating. MCAS is the thing that inhibits the natural stall behavior of the MAX, a natural stall behavior the pilots aren't trained to recognize or mitigate or recover from because they aren't supposed to get anywhere near this portion of the flight envelope - it's why MCAS exists. Take away MCAS and now its an open question whether the pilots are properly certified for that aircraft or whether the plane is not airworthy, suddenly while in-flight.

by briatx 8y ago

Obi_Juan_Kenobi 8y ago

> Computers should never overrule manual controls. I think the justification for an AoA override is there; the system was created as a result of a history of pilot error. And having to disable a switch isn't overly burdensome. The issue seems to be transparency, letting the pilots know what the system is doing so they can make a judgement to disable it.

CydeWeys 8y ago
It also needs to use three separate AoA sensors so it can detect a single malfunctioning sensor and discard its input. A system so critical, that can point the nose down and potentially cause crashes, needs more hardware redundancy in its inputs.

losvedir 8y ago

> They should have designed the MCAS system to recognize when the pilot was fighting it and to disable itself. Well "fighting" sort of begs the question, but the MCAS system was by design supposed to only activate in tandem with a pilot's actions, so it can't really work like an autopilot. It supplied stabilizer trim while the pilot was controlling the plane in order to make the ascent feel the same as the older 737's, since the different engine position on the Max 8 would otherwise make it behave differently.

briatx 8y ago
> Well "fighting" sort of begs the question For instance, if the computer is attempting to pitch the plane down, while the pilot has the yoke all the way back. It should be possible to detect without too much mind reading.
- nas 8y ago
  There is a large trim wheel (beside the pilot, about 10" in diameter) that the pilot can see turning if the system is automatically trimming. It is annoying how much speculation and misunderstanding is going on regarding that system. It might be a factor in the two crashed planes but we don't that yet.
CydeWeys 8y ago
It seems the issue is that the AoA indicator (no redundancies!) is less reliable than the actual human pilot, and thus should not be overriding the human pilot when the human thinks things are going normally (because they are) but the AoA sensor is going all funky.

deelowe 8y ago

> Computers should never overrule manual controls. The aoa system was put in place specifically to keep pilots from stalling planes. By design, it has to override manual controls. This is like saying ABS shouldn't override the brakes on a car.

briatx 8y ago
Well, how well does that work whenever the AoA sensors are faulty? All it really had to do was decrease the sensitivity of the controls not override it. Once the manual controls were pulled back all the way the computer should have disengaged. > This is like saying ABS shouldn't override the brakes on a car Remind me, does the ABS system make the car speed up?
- y4mi 8y ago
  > Remind me, does the ABS system make the car speed up? Irrelevant. Cars don't crash on deacceleration . And ABS does override the controls - especially if the user just presses as hard as he can.
  - SomeHacker44 8y ago
    Take a hard, stable turn and tap the brakes. You will soon see that you are wrong. Heck, if you are at the limit of adhesion, even lifting a little off the gas will cause a novice to crash.
outworlder 8y ago
> The aoa system was put in place specifically to keep pilots from stalling planes. No, it was put in place to correct a hardware problem (engine nacelle changes) with a software fix. It's not an anti-stall mechanism per-se. In other words, it is not a stick pusher.

nutjob2 8y ago

"Computers should never overrule manual controls." You should probably avoid Airbuses in that case, since (the opposite of) that is a central design principle. And Airbus has arguably won the design wars, since Boeing is adopting their approach, just in a half-arsed and potentially dangerous way.

nas 8y ago
Yup. The question is not if computer automation can be made 100% reliable. Instead, can it be reliable enough such that there are fewer accidents vs manual controls? The answer seems to be yes. So the trend is to more computer automation, not less. I think people who think we can go back to fully manual controls are living in a fantasy.

cmurf 8y ago

>Computers should never overrule manual controls. I disagree. I've got all kinds of examples were on conventional cable/hydraulic control to control surface aircraft a pilot can overstress the airframe, break it, and crash. If a computer were to exactly know the normal flight envelope, and always proscribe inputs that lead to certain death? I'm all for that. And what does manual control even mean with fly-by-wire airplanes? >If the autopilot is on and the pilot makes an manual adjustment to the yoke, the autopilot shuts off. That isn't how it works since the simplest roll only autopilots appeared. It seems a reasonable argument that a single pilot should be able to overpower the autopilot long enough to disable it. >They should have designed the MCAS system to recognize when the pilot was fighting it and to disable itself. Unproven. Could be true or false. Boeing has a different design philosophy than Airbus whereby they include the pilot as integrated into system design, as the primary means of determining system failures. I have no inside information, however I can imagine that MCAS is intentionally designed to only accept one sensor input for two reasons: it's simpler, and you get a fast fail in the form of what appears to be runaway trim for which there is already a procedure to follow. I have two concerns with this though: a. The reported optional pay for (?) "aoa disagree" feature which does no decoupling of MCAS, but informs pilots when the alpha vanes disagree. I think that should be standard, not optional. b. MCAS silently disabling itself is potentially very dangerous even if the 737 MAX required a separate type rating, but it's possibly a great deal worse given that it does not require a separate type rating. MCAS is the thing that inhibits the natural stall behavior of the MAX, a natural stall behavior the pilots aren't trained to recognize or mitigate or recover from because they aren't supposed to get anywhere near this portion of the flight envelope - it's why MCAS exists. Take away MCAS and now its an open question whether the pilots are properly certified for that aircraft or whether the plane is not airworthy, suddenly while in-flight.