4 ms·

The official report will make for interesting reading. The speculation over the last few days is starting to fill in some questions I've had: - Why didn't the

The official report will make for interesting reading. The speculation over the last few days is starting to fill in some questions I've had: - Why didn't the pilots identify the issue as MCAS malfunction and follow the guidence? They did and it didn't work for some reason. Possibly because of the air loads on the stabilizer. - Why did the AoA sensor on a new aircraft fail? Suspected bird strike.

woofcat 8y ago
- They did and it didn't work for some reason. Possibly because of the air loads on the stabilizer. Has the CVR transcript been released? I can't find any source on the procedures taken in the cockpit prior to the crash.
- VBprogrammer 8y ago
  I believe the media have been briefed on the the contents of the report but it isn't yet publicly available. It's annoying because I don't trust the media to get the details correct on this type of thing.
peteradio 8y ago
Why is nobody looking at the manufacturer of the sensor?
- VBprogrammer 8y ago
  If someone connected a big industrial stop switch to a solenoid and pointed that solenoid at the trigger of a rifle aimed at the person pressing the button I don't think you would expect anyone to look particularly hard at the person who manufactured the switch. If it was indeed a bird strike which took out the sensor then they seem to be completely beyond all possible blame. Even if it wasn't I'm sure they could point at a host of documentation regarding the usual MTBF of their sensors and why this application was inappropriate.
  - peteradio 8y ago
    So you are saying this was probably not spec'd for this criticality? I guess I'm curious for more information on this. Obviously don't blame the sensor manufacturer without cause but why are these things so buggy?
    - VBprogrammer 8y ago
      The sibling comment says it better than I ever could. It's a mechanical device exposed to 500mph wind speeds and temperatures from 40c to -50c. It's a wonder that they work at all. I don't think they are particularly prone to failure though. MCAS aside, having the stick shaker activate along with a host of other indications would probably be cause for a precautionary diversion by most pilots. Having no autopilot and / or an unreliable altitude would most likely disqualify the aircraft from entering RVSM airspace which is where these aircraft would normally operate.
    - salawat 8y ago
      Yes and no. Yes, the sensor is appropriate for use as an input to a safety critical system. No, it is not appropriate for a safety critical system to behave in such a manner where if that one vane failed, to kill everyone on board. While the sensor caused the cascade via it's input, it was the implementation of the listening system that allowed the rest to happen. Safety critical systems are designed with graceful degradation in mind. The fewer sources of information the system has, the more conservative it's contribution to the overall state of the system should become. There should have been integration with the second AoA sensor, pilot notification of disagree, and a lessening of the authority of the system in favor of the pilots. The pilots could then have turned the plane around, and landed it. Boeing is also on the hook for not highlighting the compounding risk presented by an airspeed unreliable failure compared with a stab trim runaway. I'd also wager they should have had an MCAS disable separate from the stab trim cutout as a result.
- matt4077 8y ago
  For reasons similar to those often cited not to blame a single operator when they accidentally drop the production database. It seems these sensors, and also pitot tubes, are notoriously unreliable. That is likely to be function of them being mechanical (moving parts) systems in rather unaccomodating environments, I. e. freezing cold, strong winds, etc. In such a scenario, one has to acknowledge the shortcomings, instead of denying them and expecting unreachable perfection. That means building systems that expect failure and have enough redundancy to mitigate them.
  - peteradio 8y ago
    Makes sense, I guess I wonder what the stated demands were of these sensors and whether they were built to reliably meet that demand.
- Xixi 8y ago
  Disclaimer: I'm not an aeronautical engineer, just a software "engineer". But between harsh atmospheric conditions, bird strikes, hornets deciding to nest where they should not [1] and mundane human/maintenance errors, sensors can and do fail. I've been taught that reliability is not achieved by building bug-free systems on top of can-never-fail hardware. Quite the opposite actually: reliability is achieved by assuming that everything and anything can and will fail. I would recommend learning Erlang to understand what a system designed from the beginning for fault-tolerance and nine nine reliability looks like. So to answer your question, nobody is looking at the manufacturer of the sensor because an AoA sensor failing should not cause a plane to crash. [1] Although not the sensor at hand in these crashes, turns out hornet nesting in a pitot tube prevents it from functioning. And they can nest very fast, while your aircraft is just lying there waiting for the next trip...
  - peteradio 8y ago
    Thanks that makes sense.

woofcat 8y ago

- They did and it didn't work for some reason. Possibly because of the air loads on the stabilizer. Has the CVR transcript been released? I can't find any source on the procedures taken in the cockpit prior to the crash.

VBprogrammer 8y ago
I believe the media have been briefed on the the contents of the report but it isn't yet publicly available. It's annoying because I don't trust the media to get the details correct on this type of thing.

peteradio 8y ago

Why is nobody looking at the manufacturer of the sensor?

VBprogrammer 8y ago
If someone connected a big industrial stop switch to a solenoid and pointed that solenoid at the trigger of a rifle aimed at the person pressing the button I don't think you would expect anyone to look particularly hard at the person who manufactured the switch. If it was indeed a bird strike which took out the sensor then they seem to be completely beyond all possible blame. Even if it wasn't I'm sure they could point at a host of documentation regarding the usual MTBF of their sensors and why this application was inappropriate.
- peteradio 8y ago
  So you are saying this was probably not spec'd for this criticality? I guess I'm curious for more information on this. Obviously don't blame the sensor manufacturer without cause but why are these things so buggy?
  - VBprogrammer 8y ago
    The sibling comment says it better than I ever could. It's a mechanical device exposed to 500mph wind speeds and temperatures from 40c to -50c. It's a wonder that they work at all. I don't think they are particularly prone to failure though. MCAS aside, having the stick shaker activate along with a host of other indications would probably be cause for a precautionary diversion by most pilots. Having no autopilot and / or an unreliable altitude would most likely disqualify the aircraft from entering RVSM airspace which is where these aircraft would normally operate.
  - salawat 8y ago
    Yes and no. Yes, the sensor is appropriate for use as an input to a safety critical system. No, it is not appropriate for a safety critical system to behave in such a manner where if that one vane failed, to kill everyone on board. While the sensor caused the cascade via it's input, it was the implementation of the listening system that allowed the rest to happen. Safety critical systems are designed with graceful degradation in mind. The fewer sources of information the system has, the more conservative it's contribution to the overall state of the system should become. There should have been integration with the second AoA sensor, pilot notification of disagree, and a lessening of the authority of the system in favor of the pilots. The pilots could then have turned the plane around, and landed it. Boeing is also on the hook for not highlighting the compounding risk presented by an airspeed unreliable failure compared with a stab trim runaway. I'd also wager they should have had an MCAS disable separate from the stab trim cutout as a result.
matt4077 8y ago
For reasons similar to those often cited not to blame a single operator when they accidentally drop the production database. It seems these sensors, and also pitot tubes, are notoriously unreliable. That is likely to be function of them being mechanical (moving parts) systems in rather unaccomodating environments, I. e. freezing cold, strong winds, etc. In such a scenario, one has to acknowledge the shortcomings, instead of denying them and expecting unreachable perfection. That means building systems that expect failure and have enough redundancy to mitigate them.
- peteradio 8y ago
  Makes sense, I guess I wonder what the stated demands were of these sensors and whether they were built to reliably meet that demand.
Xixi 8y ago
Disclaimer: I'm not an aeronautical engineer, just a software "engineer". But between harsh atmospheric conditions, bird strikes, hornets deciding to nest where they should not [1] and mundane human/maintenance errors, sensors can and do fail. I've been taught that reliability is not achieved by building bug-free systems on top of can-never-fail hardware. Quite the opposite actually: reliability is achieved by assuming that everything and anything can and will fail. I would recommend learning Erlang to understand what a system designed from the beginning for fault-tolerance and nine nine reliability looks like. So to answer your question, nobody is looking at the manufacturer of the sensor because an AoA sensor failing should not cause a plane to crash. [1] Although not the sensor at hand in these crashes, turns out hornet nesting in a pitot tube prevents it from functioning. And they can nest very fast, while your aircraft is just lying there waiting for the next trip...
- peteradio 8y ago
  Thanks that makes sense.