6 ms·

Realize some pilots lurk here...was the angle of attack sensor ever associated with an automatic system prior to MCAS? Seems like previous errors would have be

Realize some pilots lurk here...was the angle of attack sensor ever associated with an automatic system prior to MCAS? Seems like previous errors would have been less impactful due to human observation and synthesis with other instruments, window observation, etc. If so, it shows how GIGO works in automatic systems...this should have been scrutinized as AOA sensor was not above the 1:1,000,000 threshold for single-input systems w/o failover.

dreamcompiler 8y ago
> was the angle of attack sensor ever associated with an automatic system prior to MCAS? Yes [0]. The stick shaker and stick pusher. But those are overridable by pilot muscle power. With the MCAS, there can be situations where that isn't the case, and we have two crashes as a (probable) result. [0] https://philip.greenspun.com/blog/2018/11/11/boeing-737-crash-is-first-mass-killing-by-software/ https://philip.greenspun.com/blog/2018/11/11/boeing-737-cras...
Xixi 8y ago
Not a pilot, but angle of attack sensors are used with flight envelope protection systems in Airbus airliners (and probably newer Boeing planes too, though I'm not sure). Take for instance this particular incident on an A321 aircraft [1]: "two angle of attack sensors having frozen in their positions during climb at an angle, that caused the fly by wire protection to assume the aircraft entered a stall while it climbed through FL310. The Alpha Protection activated forcing the aircraft to pitch down, which could not be corrected even by full back stick input. The crew eventually disconnected the related Air Data Units and was able to recover the aircraft.". A321 have three AoA sensors, so if two freeze in the same wrong position, they outvote the good sensor... [1] https://avherald.com/h?article=47d74074 https://avherald.com/h?article=47d74074 EDIT: incomplete citation
howard941 8y ago
There are at least two A320-family AoA<>automation incidents listed here: https://en.wikipedia.org/wiki/List_of_accidents_and_incidents_involving_the_Airbus_A320_family https://en.wikipedia.org/wiki/List_of_accidents_and_incident...
- lutorm 8y ago
  Specifically: "On 5 November 2014, Lufthansa Flight 1829, an Airbus A321 was flying from Bilbao to Munich when the aircraft, while on autopilot, lowered the nose into a descent reaching 4000 fpm. The uncommanded pitch-down was caused by two angle of attack sensors that were jammed in their positions, causing the fly by wire protection to believe the aircraft entered a stall while it climbed through FL310. The Alpha Protection activated, forcing the aircraft to pitch down, which could not be corrected even by full stick input. The crew disconnected the related Air Data Units and were able to recover the aircraft."
  - cmurf 8y ago
    That's disgusting. The computer thinks the plane in a otherwise normal climb (attitude, airspeed, power, rate of climb) is stalling? That's just...we cannot call this kind of automation anything like a pilot. The term "autopilot" is too much anthropomorphizing. A pilot reacting this way in this same situation with the same information, they would be incompetent or crazy to trust two AOA sensors and assume a stall. If a crash ensued they absolutely would be blamed for it. Not the goddamn sensors. And calling such a thing a safeguard when it can fail danger like this? A 4000fpm decent as a correction for a stall in a normal climb? That's just batshit. I'm now in a dive recovery operation, itself with higher risks than a stall in the midst of a climb! A stall in a climb is not more dangerous than a 4000fpm dive. Think of throwing a football, it's stalling the entire way, all that's going to happen is the plane stops climbing as fast as it was and the nose is supposed to come down (that's why planes must have positive static stability) and viola we're flying again! Let's pretend it is true you are somehow stalling in a normal climb (an instantaneous increase in angle of attack): what do does a pilot need to do? Neutralize controls, that's it. Maybe the attitude goes somewhere between 5 and 0 degrees. But a 4000fpm decent? pUke. (I'm a pilot and former CFII, so I feel sufficiently entitled with my biases to comment with such editorialization.) The only reason we humans tolerate such unsophisticated systems arriving at weird and dangerous edge cases is because the automation has in fact helped to make flying so much safer. But so have many other things: components are so much more reliable, turbine engines run for many thousands of hours between overhauls, they're really incredible. The training is a lot better. CRM has made things way safer! It's not just the automation. And we really shouldn't be cutting automation so much slack either. I mean for fucks sake, 4000fpm? Crazy. But it's an edge case and it should not be accepted with "oh well the pilots recovered! AOK!" Obviously if the pilots had not recovered a central theme would be "the pilots didn't recover! INCOMPETENT PILOTS! THEY DIDN'T FOLLOW THE CHECKLIST! WARGARBLE! Automation is not anything like a human. So accusing it of being crazy, or trying to murder people isn't exactly accurate. But I think it's reasonable to hold it accountable to things that look like "insane" behavior when it fails this spectacularly. Its just a sequence of narrowly defined laws, with each law doing its specific thing, without any regard to other information. Very myopic worldview. And then having more authority to take (wrong) action than pilots have to correct it?! What a bad sequence!
PaulHoule 8y ago
Airbus learned this the hard way in this incident: https://en.wikipedia.org/wiki/XL_Airways_Germany_Flight_888T https://en.wikipedia.org/wiki/XL_Airways_Germany_Flight_888T which I think had to do with New Zealand regulators following up on https://en.wikipedia.org/wiki/Qantas_Flight_72 https://en.wikipedia.org/wiki/Qantas_Flight_72 A group of New Zealand pilots and regulators pressured a German pilot to test the envelope protection systems during a simulated emergency landing (so well simulated that the pilot did not seem to know where he was going ahead of time) The AoA vanes were out of commission with this aircraft, the flight protection system malfunctioned and the plane flew into the ground. That is, the danger got caught on a test flight and only 7 were killed. Compare that to the problem happening on not one but two revenue flights. Had the FAA required that pilots ride out an MCAS failure in a simulator they probably would have learned that pilots could not ride out an MCAS failure before passengers were put at risk.
- prolepunk 8y ago
  AoA vanes not just failed, they failed because of incorrect maintenance procedure. >One of the contributing causes was incorrect maintenance procedures which allowed water to enter the angle of attack (AOA) sensors. During fuselage rinsing with water before painting, three days before the flight, the AOA sensors were unprotected. As specified in the Structure Repair Manual by Airbus, it is mandatory to fit a protection device on AOA sensors before these tasks. In this case several failures all happening at the same time cause the crash: software, pilots following protocols and maintenance.
  - alexis_fr 8y ago
    Wow, that still happens? Not the first accident caused by incorrectly covering and uncovering probes during maintenance. I think once the Pitot tubes were still covered with their caps.

dreamcompiler 8y ago

> was the angle of attack sensor ever associated with an automatic system prior to MCAS? Yes [0]. The stick shaker and stick pusher. But those are overridable by pilot muscle power. With the MCAS, there can be situations where that isn't the case, and we have two crashes as a (probable) result. [0] https://philip.greenspun.com/blog/2018/11/11/boeing-737-crash-is-first-mass-killing-by-software/ https://philip.greenspun.com/blog/2018/11/11/boeing-737-cras...

Xixi 8y ago

Not a pilot, but angle of attack sensors are used with flight envelope protection systems in Airbus airliners (and probably newer Boeing planes too, though I'm not sure). Take for instance this particular incident on an A321 aircraft [1]: "two angle of attack sensors having frozen in their positions during climb at an angle, that caused the fly by wire protection to assume the aircraft entered a stall while it climbed through FL310. The Alpha Protection activated forcing the aircraft to pitch down, which could not be corrected even by full back stick input. The crew eventually disconnected the related Air Data Units and was able to recover the aircraft.". A321 have three AoA sensors, so if two freeze in the same wrong position, they outvote the good sensor... [1] https://avherald.com/h?article=47d74074 https://avherald.com/h?article=47d74074 EDIT: incomplete citation

howard941 8y ago

There are at least two A320-family AoA<>automation incidents listed here: https://en.wikipedia.org/wiki/List_of_accidents_and_incidents_involving_the_Airbus_A320_family https://en.wikipedia.org/wiki/List_of_accidents_and_incident...

lutorm 8y ago
Specifically: "On 5 November 2014, Lufthansa Flight 1829, an Airbus A321 was flying from Bilbao to Munich when the aircraft, while on autopilot, lowered the nose into a descent reaching 4000 fpm. The uncommanded pitch-down was caused by two angle of attack sensors that were jammed in their positions, causing the fly by wire protection to believe the aircraft entered a stall while it climbed through FL310. The Alpha Protection activated, forcing the aircraft to pitch down, which could not be corrected even by full stick input. The crew disconnected the related Air Data Units and were able to recover the aircraft."
- cmurf 8y ago
  That's disgusting. The computer thinks the plane in a otherwise normal climb (attitude, airspeed, power, rate of climb) is stalling? That's just...we cannot call this kind of automation anything like a pilot. The term "autopilot" is too much anthropomorphizing. A pilot reacting this way in this same situation with the same information, they would be incompetent or crazy to trust two AOA sensors and assume a stall. If a crash ensued they absolutely would be blamed for it. Not the goddamn sensors. And calling such a thing a safeguard when it can fail danger like this? A 4000fpm decent as a correction for a stall in a normal climb? That's just batshit. I'm now in a dive recovery operation, itself with higher risks than a stall in the midst of a climb! A stall in a climb is not more dangerous than a 4000fpm dive. Think of throwing a football, it's stalling the entire way, all that's going to happen is the plane stops climbing as fast as it was and the nose is supposed to come down (that's why planes must have positive static stability) and viola we're flying again! Let's pretend it is true you are somehow stalling in a normal climb (an instantaneous increase in angle of attack): what do does a pilot need to do? Neutralize controls, that's it. Maybe the attitude goes somewhere between 5 and 0 degrees. But a 4000fpm decent? pUke. (I'm a pilot and former CFII, so I feel sufficiently entitled with my biases to comment with such editorialization.) The only reason we humans tolerate such unsophisticated systems arriving at weird and dangerous edge cases is because the automation has in fact helped to make flying so much safer. But so have many other things: components are so much more reliable, turbine engines run for many thousands of hours between overhauls, they're really incredible. The training is a lot better. CRM has made things way safer! It's not just the automation. And we really shouldn't be cutting automation so much slack either. I mean for fucks sake, 4000fpm? Crazy. But it's an edge case and it should not be accepted with "oh well the pilots recovered! AOK!" Obviously if the pilots had not recovered a central theme would be "the pilots didn't recover! INCOMPETENT PILOTS! THEY DIDN'T FOLLOW THE CHECKLIST! WARGARBLE! Automation is not anything like a human. So accusing it of being crazy, or trying to murder people isn't exactly accurate. But I think it's reasonable to hold it accountable to things that look like "insane" behavior when it fails this spectacularly. Its just a sequence of narrowly defined laws, with each law doing its specific thing, without any regard to other information. Very myopic worldview. And then having more authority to take (wrong) action than pilots have to correct it?! What a bad sequence!

PaulHoule 8y ago

Airbus learned this the hard way in this incident: https://en.wikipedia.org/wiki/XL_Airways_Germany_Flight_888T https://en.wikipedia.org/wiki/XL_Airways_Germany_Flight_888T which I think had to do with New Zealand regulators following up on https://en.wikipedia.org/wiki/Qantas_Flight_72 https://en.wikipedia.org/wiki/Qantas_Flight_72 A group of New Zealand pilots and regulators pressured a German pilot to test the envelope protection systems during a simulated emergency landing (so well simulated that the pilot did not seem to know where he was going ahead of time) The AoA vanes were out of commission with this aircraft, the flight protection system malfunctioned and the plane flew into the ground. That is, the danger got caught on a test flight and only 7 were killed. Compare that to the problem happening on not one but two revenue flights. Had the FAA required that pilots ride out an MCAS failure in a simulator they probably would have learned that pilots could not ride out an MCAS failure before passengers were put at risk.

prolepunk 8y ago
AoA vanes not just failed, they failed because of incorrect maintenance procedure. >One of the contributing causes was incorrect maintenance procedures which allowed water to enter the angle of attack (AOA) sensors. During fuselage rinsing with water before painting, three days before the flight, the AOA sensors were unprotected. As specified in the Structure Repair Manual by Airbus, it is mandatory to fit a protection device on AOA sensors before these tasks. In this case several failures all happening at the same time cause the crash: software, pilots following protocols and maintenance.
- alexis_fr 8y ago
  Wow, that still happens? Not the first accident caused by incorrectly covering and uncovering probes during maintenance. I think once the Pitot tubes were still covered with their caps.