8 ms·

So a single point of failure (malfunctioning sensor) can engage the horizontal stabilizer without notifying pilots, in a way that the control yoke can't overrid

So a single point of failure (malfunctioning sensor) can engage the horizontal stabilizer without notifying pilots, in a way that the control yoke can't override. What the hell did Boeing think was going to happen?

jimktrains2 8y ago
Do we have a confirmed source that it can't be override by pilot input? My understanding was that using the stick could overcome it with other control surfaces and that the controls for trim can be set/reset by the pilot. I think Boeing has handled the aftermath (and much of the lead up since the release of the plane) very, very poorly. I, as a layman to aviation, am not willing to bet that Boeing knew the true likelihood of a problem and didn't tell anyone or had a whistle blower over it. However, if the issue with a non-redundant hydraulic value in the original 737 didn't teach us the lesson, this should: no matter the likelihood of failure, safety critical systems should always be redundant. (Also, Boeing didn't handle that original issue very well either.)
- dsfyu404ed 8y ago
  >safety critical systems should always be redundant. That's east to say from an armchair but on an aircraft everything is "safety critical" to some extent and you have to choose what gets redundancy. Something where without it you can't fly the plane sure, that make sense. The argument for considering MCAS, a system which is not necessary to fly the plane safely, to be "safety critical" is much weaker. The Lion Air crash wouldn't have happened had the pilots disabled MCAS instead of fighting it into the drink.
  - ajxs 8y ago
    I'm fairly certain that the characteristic "If this component malfunctions loss of life is one potential outcome" is a solid case for the component actually being safety critical. The pilots would never have needed to disable MCAS had it not malfunctioned in this manner. I'm not sure what redundancy has to do with this, but clearly there was a failure in a safety-critical system.
    - dsfyu404ed 8y ago
      >I'm fairly certain that the characteristic "If this component malfunctions loss of life is one potential outcome" is a solid case for the component actually being safety critical. The same thing can be said for literally tons of components on a plane. You can't have them all be redundant. At some point you have to pick and choose. A sensor for an obviously supplemental feature seems like a pretty obvious one to choose not to be redundant. >I'm not sure what redundancy has to do with this, I think the part in the GP comment where he/she state that "no matter the likelihood of failure, safety critical systems should always be redundant" has something to do with it.
      - chrisseaton 8y ago
        > You can't have them all be redundant. Why not?
        gtirloni 8y ago
        The usual, cost. But I wonder how much the redundant sensor costs for airlines to ditch it.
        cjbprime 8y ago
        Every 737 has two AoA vanes. They are redundant and the redundancy is not optional. MCAS just doesn't take advantage of there being two sensors.
        gtirloni 8y ago
        I think you're right. I misread it. My point about cost still stands. "Cockpit displays and a warning light intended to flag problems with angle-of-attack sensors in flight were optional on the Lion Air jet that crashed, according to people familiar with the matter. The carrier, like some others, chose not to purchase the feature, people familiar with the matter said, so pilots didn’t receive any such alerts." https://www.wsj.com/articles/maintenance-lapse-identified-as-initial-problem-leading-to-lion-air-crash-11545739204 https://www.wsj.com/articles/maintenance-lapse-identified-as...
  - jimktrains2 8y ago
    > That's east to say from an armchair but on an aircraft everything is "safety critical" to some extent and you have to choose what gets redundancy. In flight entertainment, non-emergency lighting, food prep, &c aren't "safety critical" any more than the TVs in hospital rooms are. As a layman, I'd've imagined that all avionics and control surface control was redundant. Don't most large planes have redundant hydraulic systems and even a deployable wind turbine to run avionics and hydraulic systems under total power loss scenarios? (And hasn't that turbine been used a few times?) Yes, weight is always a factor, but that doesn't mean that there aren't already multiple redundant, heavy, systems on aircraft. What puzzels me is that there are 2 angle of attack sensors, but they're only connected to one of the flight computers each, with the other flight computer being the redundant one. What's more Southwest ordered the optional disagree alert, so there is some way to tie and compare these sensors. Edit: > The argument for considering MCAS, a system which is not necessary to fly the plane safely, to be "safety critical" is much weaker. It controls the control surfaces; I'm not sure how it wouldn't count.
    - dsfyu404ed 8y ago
      But this isn't really "avionics and surface control" more than automatic lane keeping is a critical control system for the car. MCAS is a convenience feature that counteracts the plane's tendency to pitch up more than you want when climbing. Sure it can improve safety, so can lane keeping in a car. Neither are critical to operation. You can fly/drive perfectly safely without them so they need not be super hardened against failure because you can just switch them off.
      - jimktrains2 8y ago
        > MCAS is a convenience feature that counteracts the plane's tendency to pitch up more than you want when climbing. It's still controlling control surfaces. > Sure it can improve safety, so can lane keeping in a car. Neither are critical to operation. You can fly/drive perfectly safely without them so they need not be super hardened against failure because you can just switch them off. I'm not quite sure where to begin. Just because the absence of something would make the plane flight worthy doesn't mean the addition of it keeps the plane flight worthy. Take your lane following example. Sure, they can be turned off, but that didn't help the person whose Tesla ran straight into a jersey barrier because it got confused by it and where the lane was. (https://www.popularmechanics.com/technology/infrastructure/a21205127/ntsb-teslas-autopilot-steered-into-barrier-in-fatal-crash/ https://www.popularmechanics.com/technology/infrastructure/a...) If a mechanisms can control the vehicle, it is safe critical. It needs to fail safe under all conditions. The requirement to fail safe is part of what makes it a safety critical system. In the most extreme of examples, adding a lane following module to a car that randomly swerves into jersey barriers once at speed and if the barrier is close enough would be a clear example of a situation where the automatic controls can cause a situation that a human could not possibly react to; hence, the system itself needs to be held to much higher standards.
  - cjbprime 8y ago
    But there are already two AoA sensors on the plane. They already made it redundant. They just didn't write code to perform an agreement check as an input to MCAS. I don't think any aviation expert would agree that the case for requiring redundancy in the MCAS system is weak.
- kayfox 8y ago
  The trim adjustments by MCAS can be disabled by setting the two stabilizer trim cutout switches[1] to cut-out. The recognition that trim is being automatically adjusted outside of their ability to control the aircraft and how to correct it is considered so important to be a "memory item" or something pilots should know how to do without referring to the quick reference handbook. 1. https://aviation.stackexchange.com/questions/58798/why-doesnt-a-full-yoke-deflection-also-change-the-stabilizer-trim-on-the-boeing https://aviation.stackexchange.com/questions/58798/why-doesn...
- crooked-v 8y ago
  > Do we have a confirmed source that it can't be override by pilot input? Pilot input works... then MCAS silently does it again with up to +2.5 degrees additional adjustment, until after enough times it's maxed out the full rotation of the tail flap. See: https://www.seattletimes.com/business/boeing-aerospace/failed-certification-faa-missed-safety-issues-in-the-737-max-system-implicated-in-the-lion-air-crash/ https://www.seattletimes.com/business/boeing-aerospace/faile...
eli 8y ago
I don’t think it’s clear if it is a single point of failure or if a faulty sensor is just one precondition.
dralley 8y ago
The pilots know that the trim is moving, it's connected to a wheel in the cockpit that's super obvious. But the normal way of stopping it (the yoke) doesn't necessarily work, and the pilots wouldn't necessarily think to physically stop the wheel with their hands.
- inferiorhuman 8y ago
  But the normal way of stopping it (the yoke) doesn't necessarily work, and the pilots wouldn't necessarily think to physically stop the wheel with their hands. Well, no. Pulling on the yoke traditionally moves the elevator. MCAS adjusts the horizontal stabilizer. You can adjust the stabilizer with switches on the yoke or with the trim wheels by your knee. MCAS will pause for five seconds if the pilot hits one of the switches on the yoke (and the Lion Air pilots did this until that stopped working).
  - Someone1234 8y ago
    I believe you may have misunderstood the comment you were replying to. They were saying you cannot counteract MCAS's control inputs with the elevator alone. Which is a somewhat unconventional design, in a lot of aircraft the elevator can overpower the horizontal stabilizer, whereas with a bad sensor MCAS will continue to move the stabilizer until you cannot overcome it. To use a bad analogy, in a car the break is stronger than the accelerator, so if the peddle sticks you can still stop. In other aircraft the elevator is more powerful than the horizontal stabilizer.
    - inferiorhuman 8y ago
      They were saying you cannot counteract MCAS's control inputs with the elevator alone. Pulling on the yoke is not how you counteract a runaway stabilizer on the 737. I've pasted the relevant part of the QRH in a few previous comments. Yes, the stabilizer ultimately has more pitch authority under some circumstances. That may be what happened here, but if I'm interpreting the graphs on the preliminary report correctly I wonder about mechanical failure of some sort. This gets a bit more complex with the 737 because moving the yoke WILL actually stop one of the stabilizer trim algorithms, but not MCAS.
WalterBright 8y ago
The trim switches on the control column can override it.
- cameldrv 8y ago
  They will override it for 10 seconds, then MCAS gets back up like a zombie and tries to kill you again. If you want it dead you need to flip two cutout switches behind the throttle quadrant.
Diesel555 8y ago
All fly by wire jets have movements based on sensors. In the F-16 a faulty AOA probe is okay. 2x Faulty AOA probes are okay as long as they disagree. 2x faulty AOA probes that agree (frozen) are a very bad thing. But the loss is just a jet with an ejected seat if it can't be fixed, not nearly 200 people which is terribly sad. The worst part is from a previous Hacker News post listed below. In particular, the "Economic Problem" which states "Boeing sells an option package that includes an extra AoA vane, and an AoA disagree light, which lets pilots know that this problem was happening. Both 737MAXes that crashed were delivered without this option. No 737MAX with this option has ever crashed." https://twitter.com/trevorsumner/status/1106934369158078470?ref_src=twsrc%5Etfw%7Ctwcamp%5Etweetembed%7Ctwterm%5E1106934369158078470&ref_url=https%3A%2F%2Fwww.zerohedge.com%2Fnews%2F2019-03-17%2Fbest-analysis-what-really-happened-boeing-737-max-pilot-software-engineer https://twitter.com/trevorsumner/status/1106934369158078470?...
- mehrdadn 8y ago
  > No 737MAX with this option has ever crashed. I mean there are only two 737MAXes that have crashed in total, right? It's not like we have such a huge sample to work with for this to carry that much weight.
  - cjbprime 8y ago
    And the only airlines that bought the option are North American, so we are immediately confounding with pilot training differences.
    - tim333 8y ago
      I guess when ordering a plane or a car you assume you don't need to order optional extras to stop the thing killing you.
      - skykooler 8y ago
        I mean, some safety features such as automatic emergency braking are available but optional on many cars.

jimktrains2 8y ago

Do we have a confirmed source that it can't be override by pilot input? My understanding was that using the stick could overcome it with other control surfaces and that the controls for trim can be set/reset by the pilot. I think Boeing has handled the aftermath (and much of the lead up since the release of the plane) very, very poorly. I, as a layman to aviation, am not willing to bet that Boeing knew the true likelihood of a problem and didn't tell anyone or had a whistle blower over it. However, if the issue with a non-redundant hydraulic value in the original 737 didn't teach us the lesson, this should: no matter the likelihood of failure, safety critical systems should always be redundant. (Also, Boeing didn't handle that original issue very well either.)

dsfyu404ed 8y ago
>safety critical systems should always be redundant. That's east to say from an armchair but on an aircraft everything is "safety critical" to some extent and you have to choose what gets redundancy. Something where without it you can't fly the plane sure, that make sense. The argument for considering MCAS, a system which is not necessary to fly the plane safely, to be "safety critical" is much weaker. The Lion Air crash wouldn't have happened had the pilots disabled MCAS instead of fighting it into the drink.
- ajxs 8y ago
  I'm fairly certain that the characteristic "If this component malfunctions loss of life is one potential outcome" is a solid case for the component actually being safety critical. The pilots would never have needed to disable MCAS had it not malfunctioned in this manner. I'm not sure what redundancy has to do with this, but clearly there was a failure in a safety-critical system.
  - dsfyu404ed 8y ago
    >I'm fairly certain that the characteristic "If this component malfunctions loss of life is one potential outcome" is a solid case for the component actually being safety critical. The same thing can be said for literally tons of components on a plane. You can't have them all be redundant. At some point you have to pick and choose. A sensor for an obviously supplemental feature seems like a pretty obvious one to choose not to be redundant. >I'm not sure what redundancy has to do with this, I think the part in the GP comment where he/she state that "no matter the likelihood of failure, safety critical systems should always be redundant" has something to do with it.
    - chrisseaton 8y ago
      > You can't have them all be redundant. Why not?
      - gtirloni 8y ago
        The usual, cost. But I wonder how much the redundant sensor costs for airlines to ditch it.
        cjbprime 8y ago
        Every 737 has two AoA vanes. They are redundant and the redundancy is not optional. MCAS just doesn't take advantage of there being two sensors.
        gtirloni 8y ago
        I think you're right. I misread it. My point about cost still stands. "Cockpit displays and a warning light intended to flag problems with angle-of-attack sensors in flight were optional on the Lion Air jet that crashed, according to people familiar with the matter. The carrier, like some others, chose not to purchase the feature, people familiar with the matter said, so pilots didn’t receive any such alerts." https://www.wsj.com/articles/maintenance-lapse-identified-as-initial-problem-leading-to-lion-air-crash-11545739204 https://www.wsj.com/articles/maintenance-lapse-identified-as...
- jimktrains2 8y ago
  > That's east to say from an armchair but on an aircraft everything is "safety critical" to some extent and you have to choose what gets redundancy. In flight entertainment, non-emergency lighting, food prep, &c aren't "safety critical" any more than the TVs in hospital rooms are. As a layman, I'd've imagined that all avionics and control surface control was redundant. Don't most large planes have redundant hydraulic systems and even a deployable wind turbine to run avionics and hydraulic systems under total power loss scenarios? (And hasn't that turbine been used a few times?) Yes, weight is always a factor, but that doesn't mean that there aren't already multiple redundant, heavy, systems on aircraft. What puzzels me is that there are 2 angle of attack sensors, but they're only connected to one of the flight computers each, with the other flight computer being the redundant one. What's more Southwest ordered the optional disagree alert, so there is some way to tie and compare these sensors. Edit: > The argument for considering MCAS, a system which is not necessary to fly the plane safely, to be "safety critical" is much weaker. It controls the control surfaces; I'm not sure how it wouldn't count.
  - dsfyu404ed 8y ago
    But this isn't really "avionics and surface control" more than automatic lane keeping is a critical control system for the car. MCAS is a convenience feature that counteracts the plane's tendency to pitch up more than you want when climbing. Sure it can improve safety, so can lane keeping in a car. Neither are critical to operation. You can fly/drive perfectly safely without them so they need not be super hardened against failure because you can just switch them off.
    - jimktrains2 8y ago
      > MCAS is a convenience feature that counteracts the plane's tendency to pitch up more than you want when climbing. It's still controlling control surfaces. > Sure it can improve safety, so can lane keeping in a car. Neither are critical to operation. You can fly/drive perfectly safely without them so they need not be super hardened against failure because you can just switch them off. I'm not quite sure where to begin. Just because the absence of something would make the plane flight worthy doesn't mean the addition of it keeps the plane flight worthy. Take your lane following example. Sure, they can be turned off, but that didn't help the person whose Tesla ran straight into a jersey barrier because it got confused by it and where the lane was. (https://www.popularmechanics.com/technology/infrastructure/a21205127/ntsb-teslas-autopilot-steered-into-barrier-in-fatal-crash/ https://www.popularmechanics.com/technology/infrastructure/a...) If a mechanisms can control the vehicle, it is safe critical. It needs to fail safe under all conditions. The requirement to fail safe is part of what makes it a safety critical system. In the most extreme of examples, adding a lane following module to a car that randomly swerves into jersey barriers once at speed and if the barrier is close enough would be a clear example of a situation where the automatic controls can cause a situation that a human could not possibly react to; hence, the system itself needs to be held to much higher standards.
- cjbprime 8y ago
  But there are already two AoA sensors on the plane. They already made it redundant. They just didn't write code to perform an agreement check as an input to MCAS. I don't think any aviation expert would agree that the case for requiring redundancy in the MCAS system is weak.
kayfox 8y ago
The trim adjustments by MCAS can be disabled by setting the two stabilizer trim cutout switches[1] to cut-out. The recognition that trim is being automatically adjusted outside of their ability to control the aircraft and how to correct it is considered so important to be a "memory item" or something pilots should know how to do without referring to the quick reference handbook. 1. https://aviation.stackexchange.com/questions/58798/why-doesnt-a-full-yoke-deflection-also-change-the-stabilizer-trim-on-the-boeing https://aviation.stackexchange.com/questions/58798/why-doesn...
crooked-v 8y ago
> Do we have a confirmed source that it can't be override by pilot input? Pilot input works... then MCAS silently does it again with up to +2.5 degrees additional adjustment, until after enough times it's maxed out the full rotation of the tail flap. See: https://www.seattletimes.com/business/boeing-aerospace/failed-certification-faa-missed-safety-issues-in-the-737-max-system-implicated-in-the-lion-air-crash/ https://www.seattletimes.com/business/boeing-aerospace/faile...

eli 8y ago

I don’t think it’s clear if it is a single point of failure or if a faulty sensor is just one precondition.

dralley 8y ago

The pilots know that the trim is moving, it's connected to a wheel in the cockpit that's super obvious. But the normal way of stopping it (the yoke) doesn't necessarily work, and the pilots wouldn't necessarily think to physically stop the wheel with their hands.

inferiorhuman 8y ago
But the normal way of stopping it (the yoke) doesn't necessarily work, and the pilots wouldn't necessarily think to physically stop the wheel with their hands. Well, no. Pulling on the yoke traditionally moves the elevator. MCAS adjusts the horizontal stabilizer. You can adjust the stabilizer with switches on the yoke or with the trim wheels by your knee. MCAS will pause for five seconds if the pilot hits one of the switches on the yoke (and the Lion Air pilots did this until that stopped working).
- Someone1234 8y ago
  I believe you may have misunderstood the comment you were replying to. They were saying you cannot counteract MCAS's control inputs with the elevator alone. Which is a somewhat unconventional design, in a lot of aircraft the elevator can overpower the horizontal stabilizer, whereas with a bad sensor MCAS will continue to move the stabilizer until you cannot overcome it. To use a bad analogy, in a car the break is stronger than the accelerator, so if the peddle sticks you can still stop. In other aircraft the elevator is more powerful than the horizontal stabilizer.
  - inferiorhuman 8y ago
    They were saying you cannot counteract MCAS's control inputs with the elevator alone. Pulling on the yoke is not how you counteract a runaway stabilizer on the 737. I've pasted the relevant part of the QRH in a few previous comments. Yes, the stabilizer ultimately has more pitch authority under some circumstances. That may be what happened here, but if I'm interpreting the graphs on the preliminary report correctly I wonder about mechanical failure of some sort. This gets a bit more complex with the 737 because moving the yoke WILL actually stop one of the stabilizer trim algorithms, but not MCAS.

WalterBright 8y ago

The trim switches on the control column can override it.

cameldrv 8y ago
They will override it for 10 seconds, then MCAS gets back up like a zombie and tries to kill you again. If you want it dead you need to flip two cutout switches behind the throttle quadrant.

Diesel555 8y ago

All fly by wire jets have movements based on sensors. In the F-16 a faulty AOA probe is okay. 2x Faulty AOA probes are okay as long as they disagree. 2x faulty AOA probes that agree (frozen) are a very bad thing. But the loss is just a jet with an ejected seat if it can't be fixed, not nearly 200 people which is terribly sad. The worst part is from a previous Hacker News post listed below. In particular, the "Economic Problem" which states "Boeing sells an option package that includes an extra AoA vane, and an AoA disagree light, which lets pilots know that this problem was happening. Both 737MAXes that crashed were delivered without this option. No 737MAX with this option has ever crashed." https://twitter.com/trevorsumner/status/1106934369158078470?ref_src=twsrc%5Etfw%7Ctwcamp%5Etweetembed%7Ctwterm%5E1106934369158078470&ref_url=https%3A%2F%2Fwww.zerohedge.com%2Fnews%2F2019-03-17%2Fbest-analysis-what-really-happened-boeing-737-max-pilot-software-engineer https://twitter.com/trevorsumner/status/1106934369158078470?...

mehrdadn 8y ago
> No 737MAX with this option has ever crashed. I mean there are only two 737MAXes that have crashed in total, right? It's not like we have such a huge sample to work with for this to carry that much weight.
- cjbprime 8y ago
  And the only airlines that bought the option are North American, so we are immediately confounding with pilot training differences.
  - tim333 8y ago
    I guess when ordering a plane or a car you assume you don't need to order optional extras to stop the thing killing you.
    - skykooler 8y ago
      I mean, some safety features such as automatic emergency braking are available but optional on many cars.