4 ms·

> This article repeats the claim that the MCAS software was faulty, but is there any evidence of coding-level errors? No, there isn't. The Verge (and IIRC othe

by wsxcde 7y ago

> This article repeats the claim that the MCAS software was faulty, but is there any evidence of coding-level errors? No, there isn't. The Verge (and IIRC other sources) have reported that the crashes were due to failures in the angle of attack (AoA) sensors. No program in the world is going to give you correct output with garbage input. Verge link: https://www.theverge.com/2019/5/2/18518176/boeing-737-max-crash-problems-human-error-mcas-faa https://www.theverge.com/2019/5/2/18518176/boeing-737-max-cr...

platz 7y ago
The software did way more dumb things than it needed to in the presence of these failure modes.
- mannykannot 7y ago
  Those 'dumb' things were, in fact, the things that the domain experts specified it should do in response to the data that the software received.
michaelmrose 7y ago
No sensor failure should cause the plan to go into swan dive to destruction mode. The software that carries your tweets has to deal with exceptional situations including hardware failure so to must software that runs life critical hardware. Seems to me that if the proper response to faulty sensors was to disable MCAS perhaps it should have just done that for the pilot. Even without a second AoA sensors perhaps something could have been derived from the fact that the pilot was furiously pulling up while the aircraft was losing altitude? Defense in depth is always a good thing.
- DuskStar 7y ago
  > Even without a second AoA sensors perhaps something could have been derived from the fact that the pilot was furiously pulling up while the aircraft was losing altitude? People keep saying this. But AF 447 was caused by this. Pilot furiously pulling up, plane rapidly approaching the ground... And the steps to fix it would have been to push down. None of this is as simple as you seem to think.
  - salawat 7y ago
    AF 447 was caused by not being "ahead of the plane", or not being "10% smarter than the piece of equipment you're operating". Pilots speak of being ahead of the plane as the mental state of understanding the current condition of the aircraft, and being able to correctly forecast the end result of any control action on the current state. This is like driving a well maintained car. You know the car will "follow" your directions. Reasoning "behind the plane" is a state where the plane has started to do something, and you have to figure out what changed; I.e. the actual plane is no longer equivalent to your mental model of the plane. You can no longer with any certainty forecast the end behavior of the plane on your understanding alone. You're essentially in a reactive state. You have to rebuild your model. AF447 suffered a major automation casualty. The pilot's didn't realize this, and attempted to fly off their flawed mental models of the plane's behavior. For instance, the Stall alert becoming active when the pilot tried pitching the aircraft down being unsilenced due to the automation coming back within non-extreme input regimes. The pilot attempted to avoid the alert by returning to the extremis instead of pitching down through the alert to recoverable flight. Did the pilot's know that the alert would silence beyond an extreme value? No, but instinct told them if they did something that caused a stall response, reverse it to get away. Without the extra intelligence around how the automation worked, heuristic reasoning led to a valid, but ultimately lethally unsound course of action.
    - DuskStar 7y ago
      No disagreement at all from me. I just wanted to point out that the suggested 'should I cancel MCAS' heuristic was not nearly sophisticated enough.

by wsxcde 7y ago

platz 7y ago

The software did way more dumb things than it needed to in the presence of these failure modes.

mannykannot 7y ago
Those 'dumb' things were, in fact, the things that the domain experts specified it should do in response to the data that the software received.

michaelmrose 7y ago

No sensor failure should cause the plan to go into swan dive to destruction mode. The software that carries your tweets has to deal with exceptional situations including hardware failure so to must software that runs life critical hardware. Seems to me that if the proper response to faulty sensors was to disable MCAS perhaps it should have just done that for the pilot. Even without a second AoA sensors perhaps something could have been derived from the fact that the pilot was furiously pulling up while the aircraft was losing altitude? Defense in depth is always a good thing.

DuskStar 7y ago
> Even without a second AoA sensors perhaps something could have been derived from the fact that the pilot was furiously pulling up while the aircraft was losing altitude? People keep saying this. But AF 447 was caused by this. Pilot furiously pulling up, plane rapidly approaching the ground... And the steps to fix it would have been to push down. None of this is as simple as you seem to think.
- salawat 7y ago
  AF 447 was caused by not being "ahead of the plane", or not being "10% smarter than the piece of equipment you're operating". Pilots speak of being ahead of the plane as the mental state of understanding the current condition of the aircraft, and being able to correctly forecast the end result of any control action on the current state. This is like driving a well maintained car. You know the car will "follow" your directions. Reasoning "behind the plane" is a state where the plane has started to do something, and you have to figure out what changed; I.e. the actual plane is no longer equivalent to your mental model of the plane. You can no longer with any certainty forecast the end behavior of the plane on your understanding alone. You're essentially in a reactive state. You have to rebuild your model. AF447 suffered a major automation casualty. The pilot's didn't realize this, and attempted to fly off their flawed mental models of the plane's behavior. For instance, the Stall alert becoming active when the pilot tried pitching the aircraft down being unsilenced due to the automation coming back within non-extreme input regimes. The pilot attempted to avoid the alert by returning to the extremis instead of pitching down through the alert to recoverable flight. Did the pilot's know that the alert would silence beyond an extreme value? No, but instinct told them if they did something that caused a stall response, reverse it to get away. Without the extra intelligence around how the automation worked, heuristic reasoning led to a valid, but ultimately lethally unsound course of action.
  - DuskStar 7y ago
    No disagreement at all from me. I just wanted to point out that the suggested 'should I cancel MCAS' heuristic was not nearly sophisticated enough.