4 ms·

I don't understand... so the crashes were due to faulty single sensor. Adding computer redundancy won't fix single sensor screw up. Will they retrofit all plane

I don't understand... so the crashes were due to faulty single sensor. Adding computer redundancy won't fix single sensor screw up. Will they retrofit all planes with dual sensors?! I really don't want to fly on this airplane. This whole thing just sounds like PR trying to sell the idea that this plane will be fit to fly when it will clearly come back into active with a heap of flaws...

Filligree 7y ago
AIUI, all the planes already have dual sensors. So they wrote the software to use one at a time, alternating at each take-off...
- dTal 7y ago
  Of all the broken design decisions in the MAX, this was the one that elicited an outraged "what?!?" from me. In what possible way could this be a good idea?
  - keymone 7y ago
    A tiny additional detail - sensor alternates not because of some arbitrary adhoc rule but because aircraft always uses sensor on main pilot’s side and main pilot’s seat alternates each flight. Still boggles my mind how utterly incompetent and borderline malicious everybody involved in designing and implementing this system are. I wish we’d see some people jailed and Boeing hit with billions of dollars fines but chances are slim.
    - dTal 7y ago
      I am aware of that detail. But why? Why does the aircraft always use the sensor on the main pilot's side? That itself seems like an arbitrary, ad-hoc rule. What does global AOA state data have to do with where the pilot's ass is currently located? Why even have two sensors at all, if you only use one at a time? Given you have two sensors, why not fuse them? Any fusion logic is more intelligent than what they did. I'm sure each decision seemed logical to the person making it. But from a bird's eye view, it gives the impression of poor coordination - Team A [hardware] thinks "clearly we need multiple AOA sensors for redundancy". Team B [software] thinks "AOA isn't all that important, we barely use it and failure is non-critical. Sensor fusion is hard, let's go shopping!".
      - keymone 7y ago
        Yeah, I agree, it’s still arbitrary, just on different level.
        dTal 7y ago
        I think it's the same level. There's no evident reason why "pilot's side" is any less arbitrary than "flip a coin". Was there actually an a-priori specification that AOA sensors must always be on the pilot's side? If there is such a specification, I can't find it - Google searches for stuff like 'AOA sensors pilots side' return mostly articles about the MAX. Nor can I see a good reason for it that is concordant with the existence of paid extra feature of a disagreement light - no particular significance or weight is given to the pilot's side sensor. It sure feels like this is a post-hoc rationalization for only writing software to handle one AOA vane at a time despite being equipped with two.
        keymone 7y ago
        My speculation is that there is a class of instruments that get prioritized depending on main pilot’s side. It’s easy to assume there is a valid reason for that (ability to override and whatnot). Why would a sensor of which there are two, fall into that category - is a puzzle.
chaz6 7y ago
There is a lesser known failure mode caused by cosmic rays which planes are exposed to the higher they fly. This causes bit flipping, and can cause a critical failure in a single computer.
charlesism 7y ago
I know little about Boeing, but I'm sure the amount of money at stake, if they have a serious mechanical issue, would be staggering. I don't want to fly on a 737 Max. I worry they have too much incentive to conclude every root cause is software.
- ethbro 7y ago
  I look at it like x86 / x64 processors. There are always hardware errata. But they're patched and papered over with firmware. Essentially, I'm operating a system, and if you can guarantee the system functions as documented -- I don't really care how the sausage gets made. What I would care about is if a pilot (in this metaphor, my compiler, I guess?) doesn't feel comfortable operating the system. And I think the pilots' unions have been interesting in this. Because they don't really want to slag their employers (the airlines), but they're willing to push back hard on Boeing for essentially the same issue. A lack of transparency about and sufficient training in differences.
  - charlesism 7y ago
    > Essentially, I'm operating a system, and if you can > guarantee the system functions as documented -- I > don't really care how the sausage gets made. If a software fix for a hardware issue works well enough, I'm with you 100%. The thing about the incentive, though, is that a software fix ticks the "we did something" box, as long as it improves the issue to any degree. That it does any good at all, combined with the lower cost, can give management (or ass-covering employees) enough substance to rationalize the decision away. I doubt anyone at Boeing would willingly risk customer lives. But if they are working under pressure, and can say "well, we did do something to address the issue," that can lead to bad decisions.
deleted 7y ago
[deleted]
ethbro 7y ago
There were already two sensors. The software just wasn't configured to use both of them. I believe that's been changed too (see: AOA sensor). This article is about flight computers, which are the machines that consume sensor input.
cesarb 7y ago
> Adding computer redundancy won't fix single sensor screw up. Will they retrofit all planes with dual sensors? There are already two sensors. There are also already two computers. Each computer is already connected to one (and only one) of the sensors. Therefore, making the software use both computers at the same time allows using both sensors at the same time, with no hardware changes.

Filligree 7y ago

AIUI, all the planes already have dual sensors. So they wrote the software to use one at a time, alternating at each take-off...

dTal 7y ago
Of all the broken design decisions in the MAX, this was the one that elicited an outraged "what?!?" from me. In what possible way could this be a good idea?
- keymone 7y ago
  A tiny additional detail - sensor alternates not because of some arbitrary adhoc rule but because aircraft always uses sensor on main pilot’s side and main pilot’s seat alternates each flight. Still boggles my mind how utterly incompetent and borderline malicious everybody involved in designing and implementing this system are. I wish we’d see some people jailed and Boeing hit with billions of dollars fines but chances are slim.
  - dTal 7y ago
    I am aware of that detail. But why? Why does the aircraft always use the sensor on the main pilot's side? That itself seems like an arbitrary, ad-hoc rule. What does global AOA state data have to do with where the pilot's ass is currently located? Why even have two sensors at all, if you only use one at a time? Given you have two sensors, why not fuse them? Any fusion logic is more intelligent than what they did. I'm sure each decision seemed logical to the person making it. But from a bird's eye view, it gives the impression of poor coordination - Team A [hardware] thinks "clearly we need multiple AOA sensors for redundancy". Team B [software] thinks "AOA isn't all that important, we barely use it and failure is non-critical. Sensor fusion is hard, let's go shopping!".
    - keymone 7y ago
      Yeah, I agree, it’s still arbitrary, just on different level.
      - dTal 7y ago
        I think it's the same level. There's no evident reason why "pilot's side" is any less arbitrary than "flip a coin". Was there actually an a-priori specification that AOA sensors must always be on the pilot's side? If there is such a specification, I can't find it - Google searches for stuff like 'AOA sensors pilots side' return mostly articles about the MAX. Nor can I see a good reason for it that is concordant with the existence of paid extra feature of a disagreement light - no particular significance or weight is given to the pilot's side sensor. It sure feels like this is a post-hoc rationalization for only writing software to handle one AOA vane at a time despite being equipped with two.
        keymone 7y ago
        My speculation is that there is a class of instruments that get prioritized depending on main pilot’s side. It’s easy to assume there is a valid reason for that (ability to override and whatnot). Why would a sensor of which there are two, fall into that category - is a puzzle.

chaz6 7y ago

There is a lesser known failure mode caused by cosmic rays which planes are exposed to the higher they fly. This causes bit flipping, and can cause a critical failure in a single computer.

charlesism 7y ago

I know little about Boeing, but I'm sure the amount of money at stake, if they have a serious mechanical issue, would be staggering. I don't want to fly on a 737 Max. I worry they have too much incentive to conclude every root cause is software.

ethbro 7y ago
I look at it like x86 / x64 processors. There are always hardware errata. But they're patched and papered over with firmware. Essentially, I'm operating a system, and if you can guarantee the system functions as documented -- I don't really care how the sausage gets made. What I would care about is if a pilot (in this metaphor, my compiler, I guess?) doesn't feel comfortable operating the system. And I think the pilots' unions have been interesting in this. Because they don't really want to slag their employers (the airlines), but they're willing to push back hard on Boeing for essentially the same issue. A lack of transparency about and sufficient training in differences.
- charlesism 7y ago
  > Essentially, I'm operating a system, and if you can > guarantee the system functions as documented -- I > don't really care how the sausage gets made. If a software fix for a hardware issue works well enough, I'm with you 100%. The thing about the incentive, though, is that a software fix ticks the "we did something" box, as long as it improves the issue to any degree. That it does any good at all, combined with the lower cost, can give management (or ass-covering employees) enough substance to rationalize the decision away. I doubt anyone at Boeing would willingly risk customer lives. But if they are working under pressure, and can say "well, we did do something to address the issue," that can lead to bad decisions.

deleted 7y ago

[deleted]

ethbro 7y ago

There were already two sensors. The software just wasn't configured to use both of them. I believe that's been changed too (see: AOA sensor). This article is about flight computers, which are the machines that consume sensor input.

cesarb 7y ago

> Adding computer redundancy won't fix single sensor screw up. Will they retrofit all planes with dual sensors? There are already two sensors. There are also already two computers. Each computer is already connected to one (and only one) of the sensors. Therefore, making the software use both computers at the same time allows using both sensors at the same time, with no hardware changes.