9 ms·

Despite the headline, the article ends with: That triple-sensor system isn’t foolproof, however. In 2008, on a customer-acceptance flight of an Airbus A320, t

by js2 8y ago

Despite the headline, the article ends with: That triple-sensor system isn’t foolproof, however. In 2008, on a customer-acceptance flight of an Airbus A320, two of the angle-of-attack sensors froze and those two sensors then outvoted the third. When the pilots went to demonstrate the stall-prevention system, they were not aware of the malfunctioning sensors. The plane crashed, killing the seven people on board. The same problem arose again on a 2014 Airbus A321 Lufthansa flight leaving Spain. Eight minutes after takeoff, two of the angle-of-attack sensors froze at the same pitch. This time, after a drop in altitude, the pilots were able to regain control and complete the flight. Any automation system can fail, and when that happens, hope that through some combination of luck, skill, experience, and training, the pilot will get the plane safely to the destination.

brokenmachine 8y ago
They need triple temperature sensors on those sensors to sense when they freeze...
- brucemoose 8y ago
  you're hired!
  - dragonsky67 8y ago
    Ah, it's turtles all the way down.
- dingaling 8y ago
  Although you're being facetious, AoA sensors do have self-diagnostics that determine when their heating elements have failed. Incodentally on the A380 and A350 Airbus have changed to combined AoA-pitot sensors of which there are now four.
  - magduf 8y ago
    Sounds like Airbus airplanes are much, much safer to fly on than Boeings. Why would anyone trust a company which thinks it's OK to have a flight control system that only uses input from a single sensor that's known to fail?
argd678 8y ago
It does seem like a primitive system to use the wind for AoA, seems like there should be better and more reliable ways to determine it. Update: AoA not AoT
- TylerE 8y ago
  That's what AoA is though. It's the relative wind angle over the wing. The wind matters. You can't calculate AoA simply from pitch or vertical speed or something like that.
  - inferiorhuman 8y ago
    IIRC Boeing calculates a synthetic AoA value from the inertial reference unit in the 777 and 787, so you can derive it.
- deleted 8y ago
  [deleted]
- sollibro 8y ago
  Is there another method to measure wind direction, that doesn't involve a small physical winglet?
  - WalterBright 8y ago
    Another way would be to stick a tab in the slipstream, and measure the pressure on its leading edge and both sides. Or just put a strain gauge on the mount of the tab and measure the bending forces (and this would have no ports to freeze or moving parts to jam). I bet there are lots of ways. P.S. I bet you could even put a strain gauge on the wing spar to measure the bending force on the wing, couple that with other inputs like airspeed, and come up with a reasonable AoA value.
    - dingaling 8y ago
      The problem with such approaches is that you have to model all the environmental and performance factors that could cause an identical pseudo-AoA to be calculated, in all flight modes. And to do that you need a range of sensors, all redundant... so now you need additional input validation and sanitisation. For example, measuring slipstream over the wing is not sufficient. You need to known the pressure ratio between above and below, so there's two sensors. But airflow over a wing is not contiguous or straight, so you need more spanwise sensors to start averaging. And the inboard wing will stall first and give erroneous data, so you need to detect that and disregard it... Rather than just measuring the raw value at source.
taneq 8y ago
I've had to do a bit of functional safety stuff recently and one of the things they focus on are "common cause failures" (of which this is a perfect example - if one of the sensors freezes, the others are likely to do so as well). If you want to be sure something works, it's not enough to just have two or three copies of the same system. You have to have redundancy in manner of operation as well.
- inamberclad 8y ago
  To be specific, I'd call that functional redundancy, versus hardware redundancy. Be able to get the same thing done in different ways. NASA's Genesis mission was bit by this a while back. It had redundant parachute sequencers for a sample return capsule, but they were all assembled identically and with the G-sensors backwards. Consequently, they all failed in exactly the same way.
dragonsky67 8y ago
If there are three of the same type (make/model?) of sensor teaming to vote on the status being measured I'm not suprised that they can suffer the same failure (iceing) at the same time causing an incorrect state to be upvoted. I would have thought that for any condition there would be more than one mechanism available to sense it. You could get different devices to vote on what is the real condition. This has been done for years in visual cockpits with regards to an artifical horizon. The pilot only has to look out the window (assuming visibliity) to confirm what the instrument is reporting. Of course when the pilot loses visibility and starts to rely on their inner ear for "level" bad things can happen. Many more simple planes, especially things like gliders, have a simple ball bearing in a curved tube to indicate "down" as well as the more convential artifical horizon.
- danaliv 8y ago
  Are you talking about a turn coordinator? That doesn't show "down." The sum of forces acting in a coordinated turn will keep the ball centered even though the airplane is banked. Also I'm not sure what you're talking about with using the real horizon as a backup to the artificial horizon. It's not meant to be a redundant setup. Artificial horizons aren't required for visual (looking outside) flight, and relying primarily on the instruments in visual flight is an error. In clouds/poor visibility, the cross-check for the artificial horizon is provided by the other flight instruments: airspeed, altimeter, turn coordinator, vertical speed indicator, and directional gyro (or their equivalents on an electronic display).
  - dragonsky67 8y ago
    The point is that you are using a different type of device to cross check the reading from the first. In the case of the faulty sensor, it sounds like they are using the same type of device therefore conditions that impact the effectiveness of that device will likely impact more than one of them.
leggomylibro 8y ago
Triple-redundancy isn't 100% foolproof, but it is a lot better than two potentially-faulty sensors. I know this isn't a great example, but triple redundancy is enough of a design cornerstone that Arthur C. Clarke made it one of the defining features of Rendezvous With Rama, a classic sci-fi story about an Oumuamua-like object that people manage to land on: >It was now strikingly apparent that the "city", like so much of Rama, was triplicated. It consisted of three identical, circular complexes or superstructures, rising from a long, oval foundation. Photographs taken from the hub had also indicated that each complex was itself divided into three equal components, like a pie sliced into 120-degree portions. This would greatly simplify the task of exploration; presumably they had to examine only one-ninth of [the city] to see the whole of it. It doesn't exactly sound like a new or controversial idea, you know?
- WalterBright 8y ago
  The problem with this idea is the "identical" aspect of each redundancy. If it's identical, then it will likely suffer from the same failure mode at the same time as the others. In the case of the AoA freezing, that's exactly what happened. A more robust idea is to have three redundant subsystems, each different.
  - leggomylibro 8y ago
    Yeah, but I get the feeling that it's more of a way to ensure that you probably get at least two components that will 'burn in' well and hopefully not fail too early: https://en.wikipedia.org/wiki/Bathtub_curve https://en.wikipedia.org/wiki/Bathtub_curve Like, you don't expect them to last forever, but you do expect at least 2/3 to meet their lifetime estimates.
    - deathanatos 8y ago
      I don't think it's so much about the lifetime of the component, or whether it eventually fails due to faulty manufacturing or gradual wear and tear. (What the bathtub curve gets at.) It's that if you do make parts that are identical, and you expose them to identical unanticipated circumstances, they're likely to behave identically, and fail identically. I've seen this w/ distributed databases. I overloaded a Cassandra instance once, causing it to OOM. That node failed, but it's distributed, so another node automatically took over, ran the same query, and OOMed, and then the last guy took the query, and very quickly I had 3 dead nodes.
cletus 8y ago
Yep, 3 sensors can fail too. Less often however. These sensors exist to solve a problem with the MAX design. Changing and moving the engines increased the likelihood of a stall when the engines could push the nose up (as I understand it). Fine. But here's the kicker: this should be something that pilots should be trained on. They should be aware of how the MAX is different to the previous 737s and know what to do to disable this system if it causes problems. But that might be the end of a common type rating, which is something the airlines (and apparently Boeing) didn't want. The whole 737 MAX situation just looks like a giant clusterf--- that was a kneejerk reaction to the unexpected success of the A320neo to which Boeing had no answer and to avoid years-long development delays and losing more customers to Airbus, it really looks like they made shortcuts. And that's so damaging to their brand it really defies belief.
- xiphias2 8y ago
  I was hoping to have the damage in the Boing brand reflected more significantly in the share prices.
  - jdc 8y ago
    Maybe the problem hasn't been shouted from a high enough rooftop yet.
    - bdamm 8y ago
      Or more likely it doesn't really matter, and in a couple years nobody will really remember this about Boeing. They'll go back to being a big airplane producer that has a stunning safety record, which they are despite this issue.
      - Tsubasachan 8y ago
        The airline industry is growing and there are only two manufacturers who can build hundreds of planes on time. Airbus is already near full capacity. It would be impossible NOT to buy Boeing if you want planes.
choeger 8y ago
They should have used (n+1)-th prime sensors, dammit. When will they ever learn?
gomijacogeo 8y ago
Although a stuck AoA sensor is also going to have a very characteristic signature - no change in reported AoA. A working AoA sensor will always have some noise in the signal as the air buffets the plane. Similarly, if you maneuver the plane and the indicated AoA doesn't change at all, you can deduce the sensor is stuck and reject it (or turn on the heater, or maybe have a mechanical way to force the AoA sensor through its range of motion, etc).
rkagerer 8y ago
I'm admittedly ignorant of aircraft design but years ago when I first found out what those little AoA fins do, I was like, why the heck aren't there more of them plastered all over the place? Like, more than 3.
magicalhippo 8y ago
Couldn't one detect the frozen ones by simply noticing the loss of noise in the readings? I imagine an AoA sensor functioning normally to have a small amount of variation between readings due to turbulent air etc. Alternatively, couldn't one correlate the AoA sensor output with the accelerometer output (or some other pitch sensor)? A frozen AoA would have identical readings as the plane changes pitch, a functioning one shouldn't, no?
DanieI 8y ago
> Eight minutes after takeoff, two of the angle-of-attack sensors froze at the same pitch. If it's typical for the sensor's data to vary from 30.00 to 30.99 degrees as the wind passes over the wings and two sensors are permanently frozen at 10.42, after 8 minutes I think that there might be a high enough probability for the computer's software to decide that two sensors are broken and one is working.
Cacti 8y ago
a customer acceptance fight is a shitty way to go

by js2 8y ago

brokenmachine 8y ago

They need triple temperature sensors on those sensors to sense when they freeze...

brucemoose 8y ago
you're hired!
- dragonsky67 8y ago
  Ah, it's turtles all the way down.
dingaling 8y ago
Although you're being facetious, AoA sensors do have self-diagnostics that determine when their heating elements have failed. Incodentally on the A380 and A350 Airbus have changed to combined AoA-pitot sensors of which there are now four.
- magduf 8y ago
  Sounds like Airbus airplanes are much, much safer to fly on than Boeings. Why would anyone trust a company which thinks it's OK to have a flight control system that only uses input from a single sensor that's known to fail?

argd678 8y ago

It does seem like a primitive system to use the wind for AoA, seems like there should be better and more reliable ways to determine it. Update: AoA not AoT

TylerE 8y ago
That's what AoA is though. It's the relative wind angle over the wing. The wind matters. You can't calculate AoA simply from pitch or vertical speed or something like that.
- inferiorhuman 8y ago
  IIRC Boeing calculates a synthetic AoA value from the inertial reference unit in the 777 and 787, so you can derive it.
deleted 8y ago
[deleted]
sollibro 8y ago
Is there another method to measure wind direction, that doesn't involve a small physical winglet?
- WalterBright 8y ago
  Another way would be to stick a tab in the slipstream, and measure the pressure on its leading edge and both sides. Or just put a strain gauge on the mount of the tab and measure the bending forces (and this would have no ports to freeze or moving parts to jam). I bet there are lots of ways. P.S. I bet you could even put a strain gauge on the wing spar to measure the bending force on the wing, couple that with other inputs like airspeed, and come up with a reasonable AoA value.
  - dingaling 8y ago
    The problem with such approaches is that you have to model all the environmental and performance factors that could cause an identical pseudo-AoA to be calculated, in all flight modes. And to do that you need a range of sensors, all redundant... so now you need additional input validation and sanitisation. For example, measuring slipstream over the wing is not sufficient. You need to known the pressure ratio between above and below, so there's two sensors. But airflow over a wing is not contiguous or straight, so you need more spanwise sensors to start averaging. And the inboard wing will stall first and give erroneous data, so you need to detect that and disregard it... Rather than just measuring the raw value at source.

taneq 8y ago

I've had to do a bit of functional safety stuff recently and one of the things they focus on are "common cause failures" (of which this is a perfect example - if one of the sensors freezes, the others are likely to do so as well). If you want to be sure something works, it's not enough to just have two or three copies of the same system. You have to have redundancy in manner of operation as well.

inamberclad 8y ago
To be specific, I'd call that functional redundancy, versus hardware redundancy. Be able to get the same thing done in different ways. NASA's Genesis mission was bit by this a while back. It had redundant parachute sequencers for a sample return capsule, but they were all assembled identically and with the G-sensors backwards. Consequently, they all failed in exactly the same way.

dragonsky67 8y ago

If there are three of the same type (make/model?) of sensor teaming to vote on the status being measured I'm not suprised that they can suffer the same failure (iceing) at the same time causing an incorrect state to be upvoted. I would have thought that for any condition there would be more than one mechanism available to sense it. You could get different devices to vote on what is the real condition. This has been done for years in visual cockpits with regards to an artifical horizon. The pilot only has to look out the window (assuming visibliity) to confirm what the instrument is reporting. Of course when the pilot loses visibility and starts to rely on their inner ear for "level" bad things can happen. Many more simple planes, especially things like gliders, have a simple ball bearing in a curved tube to indicate "down" as well as the more convential artifical horizon.

danaliv 8y ago
Are you talking about a turn coordinator? That doesn't show "down." The sum of forces acting in a coordinated turn will keep the ball centered even though the airplane is banked. Also I'm not sure what you're talking about with using the real horizon as a backup to the artificial horizon. It's not meant to be a redundant setup. Artificial horizons aren't required for visual (looking outside) flight, and relying primarily on the instruments in visual flight is an error. In clouds/poor visibility, the cross-check for the artificial horizon is provided by the other flight instruments: airspeed, altimeter, turn coordinator, vertical speed indicator, and directional gyro (or their equivalents on an electronic display).
- dragonsky67 8y ago
  The point is that you are using a different type of device to cross check the reading from the first. In the case of the faulty sensor, it sounds like they are using the same type of device therefore conditions that impact the effectiveness of that device will likely impact more than one of them.

leggomylibro 8y ago

Triple-redundancy isn't 100% foolproof, but it is a lot better than two potentially-faulty sensors. I know this isn't a great example, but triple redundancy is enough of a design cornerstone that Arthur C. Clarke made it one of the defining features of Rendezvous With Rama, a classic sci-fi story about an Oumuamua-like object that people manage to land on: >It was now strikingly apparent that the "city", like so much of Rama, was triplicated. It consisted of three identical, circular complexes or superstructures, rising from a long, oval foundation. Photographs taken from the hub had also indicated that each complex was itself divided into three equal components, like a pie sliced into 120-degree portions. This would greatly simplify the task of exploration; presumably they had to examine only one-ninth of [the city] to see the whole of it. It doesn't exactly sound like a new or controversial idea, you know?

WalterBright 8y ago
The problem with this idea is the "identical" aspect of each redundancy. If it's identical, then it will likely suffer from the same failure mode at the same time as the others. In the case of the AoA freezing, that's exactly what happened. A more robust idea is to have three redundant subsystems, each different.
- leggomylibro 8y ago
  Yeah, but I get the feeling that it's more of a way to ensure that you probably get at least two components that will 'burn in' well and hopefully not fail too early: https://en.wikipedia.org/wiki/Bathtub_curve https://en.wikipedia.org/wiki/Bathtub_curve Like, you don't expect them to last forever, but you do expect at least 2/3 to meet their lifetime estimates.
  - deathanatos 8y ago
    I don't think it's so much about the lifetime of the component, or whether it eventually fails due to faulty manufacturing or gradual wear and tear. (What the bathtub curve gets at.) It's that if you do make parts that are identical, and you expose them to identical unanticipated circumstances, they're likely to behave identically, and fail identically. I've seen this w/ distributed databases. I overloaded a Cassandra instance once, causing it to OOM. That node failed, but it's distributed, so another node automatically took over, ran the same query, and OOMed, and then the last guy took the query, and very quickly I had 3 dead nodes.

cletus 8y ago

Yep, 3 sensors can fail too. Less often however. These sensors exist to solve a problem with the MAX design. Changing and moving the engines increased the likelihood of a stall when the engines could push the nose up (as I understand it). Fine. But here's the kicker: this should be something that pilots should be trained on. They should be aware of how the MAX is different to the previous 737s and know what to do to disable this system if it causes problems. But that might be the end of a common type rating, which is something the airlines (and apparently Boeing) didn't want. The whole 737 MAX situation just looks like a giant clusterf--- that was a kneejerk reaction to the unexpected success of the A320neo to which Boeing had no answer and to avoid years-long development delays and losing more customers to Airbus, it really looks like they made shortcuts. And that's so damaging to their brand it really defies belief.

xiphias2 8y ago
I was hoping to have the damage in the Boing brand reflected more significantly in the share prices.
- jdc 8y ago
  Maybe the problem hasn't been shouted from a high enough rooftop yet.
  - bdamm 8y ago
    Or more likely it doesn't really matter, and in a couple years nobody will really remember this about Boeing. They'll go back to being a big airplane producer that has a stunning safety record, which they are despite this issue.
    - Tsubasachan 8y ago
      The airline industry is growing and there are only two manufacturers who can build hundreds of planes on time. Airbus is already near full capacity. It would be impossible NOT to buy Boeing if you want planes.

choeger 8y ago

They should have used (n+1)-th prime sensors, dammit. When will they ever learn?

gomijacogeo 8y ago

Although a stuck AoA sensor is also going to have a very characteristic signature - no change in reported AoA. A working AoA sensor will always have some noise in the signal as the air buffets the plane. Similarly, if you maneuver the plane and the indicated AoA doesn't change at all, you can deduce the sensor is stuck and reject it (or turn on the heater, or maybe have a mechanical way to force the AoA sensor through its range of motion, etc).

rkagerer 8y ago

I'm admittedly ignorant of aircraft design but years ago when I first found out what those little AoA fins do, I was like, why the heck aren't there more of them plastered all over the place? Like, more than 3.

magicalhippo 8y ago

Couldn't one detect the frozen ones by simply noticing the loss of noise in the readings? I imagine an AoA sensor functioning normally to have a small amount of variation between readings due to turbulent air etc. Alternatively, couldn't one correlate the AoA sensor output with the accelerometer output (or some other pitch sensor)? A frozen AoA would have identical readings as the plane changes pitch, a functioning one shouldn't, no?

DanieI 8y ago

> Eight minutes after takeoff, two of the angle-of-attack sensors froze at the same pitch. If it's typical for the sensor's data to vary from 30.00 to 30.99 degrees as the wind passes over the wings and two sensors are permanently frozen at 10.42, after 8 minutes I think that there might be a high enough probability for the computer's software to decide that two sensors are broken and one is working.

Cacti 8y ago

a customer acceptance fight is a shitty way to go