9 ms·
'I’ve become isolated': the aftermath of near-doomed QF72
- rosege 7y agoIts not only Boeing thats had issues with automation: "I've learnt from these events, but none have generated the body response or trauma that this one has on October 7, 2008. This scenario involving computers, denial of control and potential mass casualties is at a different level. It seems we've survived a science-fiction scenario, a No Man's Land of automation failure on an unprecedented scale."
- CydeWeys 7y agoAt least none of these incidents killed anyone. Boeing's automation (MCAS specifically) has a lot of blood on its hands.
- rosege 7y agoYes good point! But it seems by luck/good piloting that it didn't kill anyone.
- CydeWeys 7y agoI think it's more than luck. The Airbus automation systems had sane failure modes. They realized they were dealing with malfunctioning input and returned manual control to the pilots. The 737 MAXes, on the other hand, trimmed the planes down all the way until they impacted into the ground. Also, the Airbus autopilot could be disabled. The 737 MAX MCAS system couldn't be; all they could disable was all electronic control over the trim motors, which shut off MCAS but also shut off the system they needed to be able to recover the trim entirely.
- makomk 7y agoLess luck, more good design. The accident investigation report reckons that this was close to the worst-case scenario: the first pitch-down was almost at the maximum possible, the other fault protection systems made it unlikely that more than two such uncommanded pitch-downs could happen in a flight, and it wasn't possible for this to happen anywhere near close enough to the ground that the pilots wouldn't be able to recover even if they panicked.
- ncmncm 7y agoThis is heartbreaking. Only a markedly superior flight officer would be affected the way he was, and it made him unable to continue. The flying public loses one of its best protectors.
- toss1 7y agoExactly -- "The flying public loses one of its best protectors." And the loss is the direct result of badly designed and badly implemented software automation. Yet, software continues to eat everything, and large swaths of the industry praise a "move fast and break things" attitude about it. Even life-critical industries consider it OK to make airframe changes rendering a passenger aircraft unstable in parts of the performance envelope and patch it over with software supposedly compensating for those new flight characteristics, dependent on a single faulty sensor and no input sanity checking. After 346 people die in two incidents, they reconsider, only after forced by regulators. This <it'll be OK, just patch it> attitude needs to be eradicated.
- makomk 7y agoThe thing is, the software automation wasn't badly designed and badly implemented. This isn't like Boeing's non-redundant MCAS system - a huge amount of engineering work was put into making every part of the system redundant and robust against erroneous data from a failing component and verifying that it worked as intended. It's just that some really weird, rare failure mode that no-one anticipated or ever found the cause of somehow created a data pattern which foiled all those checks.
- toss1 7y ago"making every part of the system redundant"? Really? From every account I've read, it depended entirely upon a single flight attitude sensor, and did no sanity checking whatsoever against other data, sensors, or inputs. There was an extra-cost-option for a second AOA sensor and an obscure cockpit light that would tell when the two AOA sensors disagreed, but those were not installed in either of the crashed airplanes. It seems at the very least, such a critical system should have three primary sensors with full algorithms to check for disagreement, plus checking against the artificial horizon display inputs, airspeed, throttle, etc. to determine if they were actually in the part of the envelope where the MCAS would be useful. So, unless it there are a number of checks & features that have been written in no account I've read, it's really bad design -- software. Moreover, they could have decided to NOT design the airframe so that it would have deadly characteristics requiring a software patch to hide. Again, really bad design - airframe. Or, they could have decided that this is a potential critical and deadly failure mode which properly required extra training and a new Type Rating for pilots to fly the new aircraft. But instead they decided to try to bury it in the same type and an hour of iPad training, so that their airline customers would see the a lower overall cost of the new model. Again, really bad design -- process. Perhaps you can point me to some documentation I'm missing here, but this is what I've consistently gathered from the substantial number of articles I've read.
- mjevans 7y agoThe humans are required to be there for a reason, and that reason is so important TWO are required to be inside the control cabin at ALL TIMES. If they aren't given the final say in what course of action should be happening at a given moment it's been designed wrong. "For a pilot, loss of control is the ultimate threat. It's our job to control the aircraft, and if computers and their software, by design, can remove that functionality from the pilot, then nothing good is going to come out of that."
- chrischattin 7y agoPilot here. 100% agree. An autopilot isn't autonomous (like the most of the public think). It's more like flying the plane by pushing buttons vs manipulating the flight controls. You dial up a heading or altitude and press execute. You still have to watch it closely and it does mess up quite often ie: won't capture a localizer, altitude wasn't armed, etc. Procedure in the cockpit is to call out altitudes like "1000 above" when leveling off. I've flown an F-16 where the fly by wire system won't let you over G the jet. So, I think some level of automation is good in that regard. But, it's very subtle and you feel in control at all times. I would never fly an aircraft that would actively take over control of the aircraft... because the automation messes up all the time.
- nabla9 7y agoHN has had two classes of aviation technology articles recently: - Horrible examples of automation going wrong, hard to design and failing easily. - Autonomous app-based air taxis are coming together with automated urban air traffic control (Uber and others). Market estimated to be worth €1.5 trillion by Morgan Stanley analysis. What's your take?
- yholio 7y agoAir taxis will become possible only when a quiet method of vertical take off and landing is developed, if ever. No current VTOL lightweight aircraft would be able to gain even experimental status in an urban environment, let alone thousands of them running at all hours of the day. The noise levels propellers make are absolutely horrendous.
- ralph84 7y ago> Qantas Flight 72 is descending in a nose-low altitude for just over 15 seconds Yes, aviation-ignorant editor, he really did mean to write attitude before you changed it to altitude.
- kbcool 7y agoYou assume mainstream newspapers have editors, ones that actually edit, these days :)
- eecc 7y agoUhm, you’re arguing with an automaton, a spelling checker. Apt and ironic, given the circumstances
- mprev 7y agoMore likely a human sub-editor on a paper like the Sydney Morning Herald, surely.
- rosege 7y agoYes I would think so too
- usrusr 7y agowhy would a spell checker prefer altitude over attitude?
- njepa 7y agoI would think that even a slightly sophisticated spell checker would catch this. So arguably a lack of automation. Could of course be a human machine interaction problem, where the misguided human and machine makes errors together.
- L_226 7y agoAustralian here. SMH is known for a generally poorer standard of English usage and editing compared to other news publications (e.g. The Australian).
- guicho271828 7y agorelated article https://en.wikipedia.org/wiki/Qantas_Flight_72#FCPC_design_limitation https://en.wikipedia.org/wiki/Qantas_Flight_72#FCPC_design_l...
- nexuist 7y agoAren't there standards on what is considered a safe flight maneuver? Small adjustments here and there are fine, but sudden pitch downs like those encountered on QF72 and with MCAS should be cross checked and analyzed by the computer systems. This is the whole point of triple redundancy, not just to maintain an accurate reading but also to detect when the reading accuracy has failed so you can respond accordingly. Of course for every QF72 there are probably a bunch of injuries and deaths attributed to pilot error, which is why the computers are there, but at some point there has to be a middle ground. If you defer control to the computers in all situations, what's the point of the pilots? If these computers and their software are smart enough to make life critical decisions, why can't they make the most important decision of all: should I stop?
- p_l 7y agoThe flight computer responses were ones that help ensure that the airplane remains in safe maneuvering range when air movement suddenly shifts around. For example, a sudden encounter with wind shear might push an otherwise well-trimmed aircraft into just that kind of move, and the FBW computer would be expected to compensate. In this case, the "eyes and ears" of flight computers failed in ways that were unknown to designers and thus bypassed safety measures against their failure.
- bamboozled 7y agoI don't really get the point of your statement. There was still an extremely competent ready and able pilot at the helm who should've been able to disengage the auto-pilot features of a plane with faulty sensors, take control and land safely but couldn't. Seems like ridiculous failure mode to be honest.
- PaulHoule 7y agoIt's not "autopilot" it is "flight envelope protection".
- pmyteh 7y agoYes, there are standards. The full Australian accident report finds that the 3 times in 29M flying hours that this issue occurred were within the standard (for a non-catastrophic issue, as they found this was). The systems did indeed cross-check, but there was an algorithmic edge case where the incorrect data was inappropriately used anyway, as happened here. It also did give control back to the pilots: after the second nose-down, the control law reverted as designed to 'alternate' (a degraded state) which removed the part of the envelope protection causing the nose downs. And the pilots also correctly switched to the backup ADIRU, which disconnected the faulty data from (most of) the aircraft's systems. For me, the interesting part of the article is the severe consequences for the pilot's mental health. A serious, but non-catastrophic problem occurs, and is skillfully dealt with by the crew (whose training is designed for exactly this). There are a number of injuries, but none are life-threatening. But the pilot's sense of responsibility, the feeling that it could all have been much worse, and a loss of faith in the aircraft, results in long term disability despite the 'successful' result.
- snowwindwaves 7y agoAn automation failure is scary because nobody understands what is going on or what can be done about it. Mechanical failures also occur and the risk is accepted. What are the odds of a bird strike? What are the odds of a bird strike being dangerous or catastrophic? Although Boeing isn't helping, Probably the odds or number of occurrences of mechanical failures with bad outcomes is way higher than For electronics or automation. Is it a Similar situation to coal and nuclear power? Better the devil you know.
- notimetorelax 7y agoI agree with you, still statistics doesn’t excuse bad engineering practices as we observed at Boeing. And if those practices continue the stats might reverse.
- simion314 7y agoRelated to Boeing old stats may be irrelevant since a big change in the process happened and the MAX plane updates were rushed, corners were cut, pilots were not informed on the changes and on top of that after the first crash Boeing proved that they would risk other crashes then grounding the planes until the fix is ready and even on top of that still after the first crash the pilots did not know that disagree lights won't turn on on some planes. It looks to me and I hope the investigation would find the proof that Boeing hoped they can push an update fast enough before the next crash and that with some luck the first crash fault would not be conclusive and they could blame the pilots or the airline.
- deleted 7y ago[deleted]
- sgt101 7y agoThe lesson is that automation can fail suddenly, even in domains like aerospace which are unusual in that they have an infrastructure of professionalism and safety. If an automatic system fails and then leaves the system in a position that humans can't recover from then the failure will be complete. This is not real supervision, automatic systems must be designed to relinquish control before the situation is dangerous.
- usr1106 7y agoA write-up of the technical side http://avherald.com/h?article=40de5374 http://avherald.com/h?article=40de5374
- checker659 7y agoWhat are the odds Boeing paid for this article to be published? This incident happened in 2008. https://en.wikipedia.org/wiki/Qantas_Flight_72 https://en.wikipedia.org/wiki/Qantas_Flight_72
- spuz 7y agoSeeing as the article doesn't specifically say anything negative about Airbus and it's an extract from a book released this month, I would find that incredibly unlikely.
- eecc 7y agoIndeed it reads that as the final bits of data streamed out of the recordings, Airbus realizing what a lucky break they had when no one died from this f*ck-up, they rushed to fix the software and issue new procedures to turn off the dodgy computers. In the more recent cases, with 100% death counts, I read unsubtle accusations at third world pilots not knowing how to fly planes
- robkop 7y agoHow about very low? At the end of the article it mentions that the article is mostly an extract from the Caption's book. Which is coming out in roughly two weeks time.
- dmitrygr 7y agoSeems to be an ad for a book by said captain to come out soon, so unlikely to be Boeing related
- mkl 7y agoI doubt that Boeing paid to have it published or anything like that, but I wouldn't be surprised if the publisher has rushed to get it ready for publication given how topical it seems right now. This article will be getting way more attention than it otherwise would have (if the article would have even existed without recent Boeing mishaps).
- 7y ago
- airthrowway2 7y agoI believe the pilots should intimately undestand the systems and the automation and have the ability to understand what the plane does and why, especially when it is wrong. In this case knowing the FBW envelope protections of airbus it was clear that the system was responding to a high angle of attack situation to avoid stalling, of course it was wrong and after disconnecting the autopilot the pilot should have immediately turned off the 2 out of the 3 ADIRUs to force the plane into alternate law where those protections are off.
- rdiddly 7y agoInteresting how what is essentially a success in handling a crisis, can still be traumatic. It seems like I recall Chesley Sullenberger being on record stating that he and the rest of the crew of that "miracle on the Hudson" flight suffered from PTSD symptoms for weeks.
- PaulHoule 7y agoIt's not that hard to get. I hit a dog with my car and had flashbacks and intrusive thoughts about it for about three weeks.
- PaulHoule 7y agoNote that New Zealand regulators were inspired by QF72 to provoke the following accident: https://en.wikipedia.org/wiki/XL_Airways_Germany_Flight_888T https://en.wikipedia.org/wiki/XL_Airways_Germany_Flight_888T which reads like something right out of Perrow's "Normal Accidents" book in that it was an incredible confluence of hardware and human failures.
- mcguire 7y ago"Provoke"? They seem unrelated.
- PaulHoule 7y agoThe wikipedia article doesn't explain it well compared to the accident reports. The regulators were trying to test the envelope protection system under stressful conditions and it turned out that the AoA vanes were non-functioning which contributed to the crash. Thus it is relevant to the later 737 MAX crashes. It is a "normal accident" because of the human factors: e.g. no flight plan filed because it was a test flight, regulators ordering the pilots to defy the air traffic controllers, regulators ordering pilots to go forward with a test they didn't want to do... And on top of it all a maintenance error.
- tomohawk 7y agoAs we go through life, we place faith in things based on past experience or on what other people say. In this case, the pilot lost faith in the aircraft automation and could not ever really trust it again. He couldn't live in the illusion that hurtling along at 600mph with computers in control is inherently safe at all times. His new reality is that computers bear watching at all times. That sort of hyper vigilance has got to be extremely taxing. It's important to not place faith in things.
- mopsi 7y agoA similar thing happened with the captain of SAS MD-81 in 1993[1]. Clear ice had formed on the upper side of wings overnight, but it was not detected during de-icing. Shortly after takeoff, pieces of ice broke off and hit engines, deforming fan blades, which disturbed airflow and caused right engine to surge 25 seconds into the flight. Pilots properly responded with thrust reduction to decrease engine stress, but unknown to them, the MD-81 had been fitted with Automatic Thrust Restoration[2] that kept increasing thrust to maintain normal climb setting. Increased thrust led to surging of the left engine too, until both engines failed at 78 seconds. The aircraft crashed into a field and broke into three parts (everyone survived).[3] Post-crash analysis determined that reduced thrust would have kept both engines operational, and maintained thrust would've lead to failure of only the right engine, which would have allowed to keep flying and perform a safe landing. ATR increased thrust and caused both engines to fail. Captain of the flight retired from flying, saying that he lost trust in airplanes. [1] https://en.wikipedia.org/wiki/Scandinavian_Airlines_Flight_751 https://en.wikipedia.org/wiki/Scandinavian_Airlines_Flight_7... [2] https://patents.justia.com/patent/4662171 https://patents.justia.com/patent/4662171 [3] https://i.imgur.com/k4q0WMm.png https://i.imgur.com/k4q0WMm.png and https://i.imgur.com/KzPNhsU.jpg https://i.imgur.com/KzPNhsU.jpg
- IfOnlyYouKnew 7y agoFor every vindicated hero, there are probably dozens of pilots who would no longer be alive without smarter systems. Airline fatalities decreased 10-fold in the last 30 years, while total miles travelled increased by the same factor. Flying today is 100x safer now, and I don't quite understand peoples' fetish with human control.
- whyenot 7y agoWhere do those figures come from? They appear to be completely inaccurate. Looking here [1], while there has certainly been a reduction in fatalities over the past 30 years, it's not even close to 10x. Maybe 2x or 4x. As far as miles travelled, there has been at best a 2x increase over the past 30 years, at least for the US[2]. Airline travel certainly has become safer, at least on a per-mile basis, but 100x safer? That's fantasy. 1. https://en.wikipedia.org/wiki/Aviation_accidents_and_incidents#Statistics https://en.wikipedia.org/wiki/Aviation_accidents_and_inciden... 2. https://www.bts.gov/content/us-passenger-miles https://www.bts.gov/content/us-passenger-miles
- craftinator 7y agoThis story brought to you by Boeing; please try out our new 737 Max at your next opportunity!
- craftinator 7y agoAnyone know why autopilot cutoff switches aren't a thing? I know these aircraft aren't designed for pure manual operation, but I don't understand why there is not a way to downgrade the level of computer control, turn off all but the most simple autopilot functions. Anyone here in the know on this?
- gbacon 7y agoThey are, even with autopilots in general-aviation airplanes that commonly have a disable button on the control yoke, a button on the panel, and a circuit breaker to cut George's power.
- craftinator 7y agoAh I was more aluding to the automatic system that caused the crashes (MCAS I believe), but after a bit of research it seems this is not an autopilot function, more of a flight assist function. Still, it kinda blows my mind that any system that can forcibly counteract the pilot's control could not come with an off switch. I'd feel uncomfortable if my car didn't have an off switch for traction control.
- xfitm3 7y agoThis really resonates with me: "One thing is certain: the computers blocked my control inputs. For a pilot, loss of control is the ultimate threat. It's our job to control the aircraft, and if computers and their software, by design, can remove that functionality from the pilot, then nothing good is going to come out of that."