5 ms·

Now, imagine you have 5,000 such checks in millions of lines of flight control system code, many of them interdependent, and you have to fly the ship to test ea

Now, imagine you have 5,000 such checks in millions of lines of flight control system code, many of them interdependent, and you have to fly the ship to test each one. You need to schedule time with the test pilots (who have lives of their own) and get the data dump from IT post-flight. It's aerospace so all this undergoes review, documentation, and signoff, and it all takes time. How do you prevent a single check from slipping through? It's not easy. These software engineers and others in the process screwed up, but it's a failure of processes and not just forgetting a conditional statement.

cpplinuxdude 8y ago
I'm sorry i'll have to mention that the software can be thoroughly tested in simulation flights. Funnily enough i was involved with some virtualisation software used to test booking systems for Airports. If you can virtualise a booking systems, trust me you can virtualise the on-board flights systems.
- hw 8y ago
  No doubt you can test on-board flight systems, but you can't really compare virtualizing a booking system with flight systems, which are much more complicated and delicate. Now if you worked at SpaceX and worked on testing their flight systems, then I'd be more inclined to trust you.
  - cpplinuxdude 8y ago
    > Now if you worked at SpaceX and worked on testing their flight systems, then I'd be more inclined to trust you Wow that's harsh. You may want to add a bit of sugar to that; it's not nice addressing fellow developers like that. Just a thought.
- rhinoceraptor 8y ago
  You can't perfectly simulate the pilot though, that's the big danger with human/automation hybrids. As with what potentially happened to these crashes, the operating procedures might not be fully known by the pilot. The simulation might also allow the simulated pilot to do things that humans can't, for example turn the trim wheel when the jackscrew is under heavy load from the nose being pitched down.
- yaur 8y ago
  Is this really true though? From what I have read it sounds like part of the problem is that manually adjusting the trim wheel requires more strength than at least some pilots possess due to the mechanical forces on the plane. I don't think it's reasonable to expect simulators to replicate those types of forces.
  - cjbprime 8y ago
    But they do! See the Vimeo link elsewhere in these comments.
chupa-chups 8y ago
- The MCAS system has more trim authority than the usual (assisted) system - It was originally intended to have an authority of +/- 0.6 degrees of trim - Later it was discovered that this it not enough due to the aerodynamic effects of the engines becoming apparent also at lower speeds, which led boeing to increase authority to +/- 2.5 degrees per iteration with unlimited iterations until the maximum range If you don't believe me, see pprune.org (real pilots discussing the issue) and https://www.satcom.guru/2018/11/stabilizer-trim.html https://www.satcom.guru/2018/11/stabilizer-trim.html This is not a software fault.
- Gibbon1 8y ago
  Unless I'm wrong disabling the MCAS system leaves the elevator at the current trim as set by the jack screw. That's really not the behavior you want. You want the control to return to neutral. Which probably isn't the way the trim mechanism is designed. This whole thing smells like a bunch of dodgy decisions. Some of them recent and others historical. For instance not being able to manually adjust trim while the elevator is under load. That's dodgy, they got away with it because runaway trim is really rare.
  - fixermark 8y ago
    Not a pilot yet myself, but I know exactly enough about flight physics and control to suspect that while you are likely correct about the MCAS jack-screw positioning being undesired, the solution is probably not to auto-return it to neutral. If we assume MCAS is only disabled in an emergency, we don't want the result of cutting out an automated system to be further automatic manipulation of the control surfaces, right? That's one more weird behavior for the pilots to have to keep in their situational awareness while doing the most important step (i.e. flying the plane).
    - Gibbon1 8y ago
      > we don't want the result of cutting out an automated system to be further automatic manipulation of the control surfaces, right? You have two separate things a pilot may need to do. One is disabling the MCAS control action. In that case you do want it to return to normal trim. Second is disabling the Automatic/Electrical Trim. In that case you want it to stop and allow the pilot to set the trim manually.
pdx_flyer 8y ago
It's more an issue of Boeing essentially signing off on their own certification as functionally the same type when it is a very different plane. The AOA calculation is also much more complicated than the article explains. There is a speed element, engine power, etc.
- chupa-chups 8y ago
  AoA is just that: angle of attack (https://en.wikipedia.org/wiki/Angle_of_attack https://en.wikipedia.org/wiki/Angle_of_attack) The sensor simply measures the angle of the airflow with respect to the airframe. In fact it is just a free-moving surface attached to the airframe.
  - pdx_flyer 8y ago
    I know what AoA is and yes, the calculation of AoA by itself is simple, but the corrective measure is not. Classic 737s climb via trim, not constant stick inputs. This has changed slightly with the MAX but now you have automated AoA correction (involving trim). That's a nasty combination.
    - VBprogrammer 8y ago
      That's not nearly the case. MCAS is a stupidly simple system intended to cut in during very unusual phases of flight were a normal commercial flight would not be operating.
      - linuxftw 8y ago
        > MCAS is a stupidly simple system So, you have reviewed the software? If it's so stupid simple, why did it kill a bunch of people?
        VBprogrammer 8y ago
        Sigh. I've reviewed almost everything written about the accidents including the information supplied by Boeing to the airlines to explain the function of the MCAS system. There is no lower limit on the complexity of a system required to kill people.
dingaling 8y ago
> How do you prevent a single check from slipping through? For a start, by not ramming an essentially new type through all test flying & certfication testing in 17 months before declaring it ready for service. There is a reason that the Soviet Ministry of Aviation made newly-approved types fly only cargo and mail for a year or more; not just because their techniques were 'unsophisticated' per the Western view but also because they understood that introducing a complex system into a complex environment of weather and human factors couldn't be fully modelled but had to be subjected to prolonged real-World experience.

cpplinuxdude 8y ago

I'm sorry i'll have to mention that the software can be thoroughly tested in simulation flights. Funnily enough i was involved with some virtualisation software used to test booking systems for Airports. If you can virtualise a booking systems, trust me you can virtualise the on-board flights systems.

hw 8y ago
No doubt you can test on-board flight systems, but you can't really compare virtualizing a booking system with flight systems, which are much more complicated and delicate. Now if you worked at SpaceX and worked on testing their flight systems, then I'd be more inclined to trust you.
- cpplinuxdude 8y ago
  > Now if you worked at SpaceX and worked on testing their flight systems, then I'd be more inclined to trust you Wow that's harsh. You may want to add a bit of sugar to that; it's not nice addressing fellow developers like that. Just a thought.
rhinoceraptor 8y ago
You can't perfectly simulate the pilot though, that's the big danger with human/automation hybrids. As with what potentially happened to these crashes, the operating procedures might not be fully known by the pilot. The simulation might also allow the simulated pilot to do things that humans can't, for example turn the trim wheel when the jackscrew is under heavy load from the nose being pitched down.
yaur 8y ago
Is this really true though? From what I have read it sounds like part of the problem is that manually adjusting the trim wheel requires more strength than at least some pilots possess due to the mechanical forces on the plane. I don't think it's reasonable to expect simulators to replicate those types of forces.
- cjbprime 8y ago
  But they do! See the Vimeo link elsewhere in these comments.

chupa-chups 8y ago

- The MCAS system has more trim authority than the usual (assisted) system - It was originally intended to have an authority of +/- 0.6 degrees of trim - Later it was discovered that this it not enough due to the aerodynamic effects of the engines becoming apparent also at lower speeds, which led boeing to increase authority to +/- 2.5 degrees per iteration with unlimited iterations until the maximum range If you don't believe me, see pprune.org (real pilots discussing the issue) and https://www.satcom.guru/2018/11/stabilizer-trim.html https://www.satcom.guru/2018/11/stabilizer-trim.html This is not a software fault.

Gibbon1 8y ago
Unless I'm wrong disabling the MCAS system leaves the elevator at the current trim as set by the jack screw. That's really not the behavior you want. You want the control to return to neutral. Which probably isn't the way the trim mechanism is designed. This whole thing smells like a bunch of dodgy decisions. Some of them recent and others historical. For instance not being able to manually adjust trim while the elevator is under load. That's dodgy, they got away with it because runaway trim is really rare.
- fixermark 8y ago
  Not a pilot yet myself, but I know exactly enough about flight physics and control to suspect that while you are likely correct about the MCAS jack-screw positioning being undesired, the solution is probably not to auto-return it to neutral. If we assume MCAS is only disabled in an emergency, we don't want the result of cutting out an automated system to be further automatic manipulation of the control surfaces, right? That's one more weird behavior for the pilots to have to keep in their situational awareness while doing the most important step (i.e. flying the plane).
  - Gibbon1 8y ago
    > we don't want the result of cutting out an automated system to be further automatic manipulation of the control surfaces, right? You have two separate things a pilot may need to do. One is disabling the MCAS control action. In that case you do want it to return to normal trim. Second is disabling the Automatic/Electrical Trim. In that case you want it to stop and allow the pilot to set the trim manually.

pdx_flyer 8y ago

It's more an issue of Boeing essentially signing off on their own certification as functionally the same type when it is a very different plane. The AOA calculation is also much more complicated than the article explains. There is a speed element, engine power, etc.

chupa-chups 8y ago
AoA is just that: angle of attack (https://en.wikipedia.org/wiki/Angle_of_attack https://en.wikipedia.org/wiki/Angle_of_attack) The sensor simply measures the angle of the airflow with respect to the airframe. In fact it is just a free-moving surface attached to the airframe.
- pdx_flyer 8y ago
  I know what AoA is and yes, the calculation of AoA by itself is simple, but the corrective measure is not. Classic 737s climb via trim, not constant stick inputs. This has changed slightly with the MAX but now you have automated AoA correction (involving trim). That's a nasty combination.
  - VBprogrammer 8y ago
    That's not nearly the case. MCAS is a stupidly simple system intended to cut in during very unusual phases of flight were a normal commercial flight would not be operating.
    - linuxftw 8y ago
      > MCAS is a stupidly simple system So, you have reviewed the software? If it's so stupid simple, why did it kill a bunch of people?
      - VBprogrammer 8y ago
        Sigh. I've reviewed almost everything written about the accidents including the information supplied by Boeing to the airlines to explain the function of the MCAS system. There is no lower limit on the complexity of a system required to kill people.

dingaling 8y ago

> How do you prevent a single check from slipping through? For a start, by not ramming an essentially new type through all test flying & certfication testing in 17 months before declaring it ready for service. There is a reason that the Soviet Ministry of Aviation made newly-approved types fly only cargo and mail for a year or more; not just because their techniques were 'unsophisticated' per the Western view but also because they understood that introducing a complex system into a complex environment of weather and human factors couldn't be fully modelled but had to be subjected to prolonged real-World experience.