4 ms·

Just look at the MCAS disaster. The only override that wasn't under its control required someone present in the cockpit to basically physically lift the plane u

by josefx 4y ago

Just look at the MCAS disaster. The only override that wasn't under its control required someone present in the cockpit to basically physically lift the plane using a normally automated control. This illustrates two things: First the design of the software used in commercial airplanes is bat shit insane and second, the fallbacks require that a trained person is physically present on the plane. > We have been using remote controlled killer drones for years now. While Boeing has shown some talent at killing people the goal of commercial airplanes is usually to get their passengers to their destination alive.

WalterBright 4y ago
I know a bit about the MCAS disaster. Very few people know that there were *three* incidences of MCAS runaway trim. What happened with the third one (which was actually the first incident)? It didn't crash. The pilot just turned off the stab trim system. The override was there, it was always there. The thumb switches on the control column overrode it. Turning it off with the STAB TRIM CUTOFF switch turned it off. This procedure was detailed in an Emergency Airworthiness Directive issued to all 737MAX pilots after the first crash. The pilots in the second crash did not follow that procedure. The pilots of all three incidents used the thumb switches to override MCAS and restore normal trim. The first crew then turned off the trim and landed safely. The second crew never did turn off the trim and crashed. The third turned off the trim when the airplane was in a dive and could not recover.
- kozak 4y ago
  It is also interesting that in that third incident it was the presence of a THIRD pilot in the cockpit that helped to diagnose the problem.
- bobkazamakis 4y ago
  Huh, if only there could have been some kind of training that would be required to use this new system, but that would require recertification!
  - thefounder 4y ago
    Or if this system wasn't so badly designed to require yet another training class.
  - WalterBright 4y ago
    Pilots are already trained to turn off the STAB TRIM when it misbehaves. The switch to do it is prominent on the console for good reason.
- chmod775 4y ago
  > Turning it off with the STAB TRIM CUTOFF switch turned it off. > The pilots in the second crash did not follow that procedure. "At 05:40:35, the First-Officer called out 'stab trim cut-out' two times. Captain agreed and First-Officer confirmed stab trim cut-out."[1] However they were unable to correct the trim of the aircraft without help of the electrical systems (still being on full takeoff power didn't help). So around 3 minutes later stab trim cutout was switched back to normal. Pretty much the moment they did that the aircraft pitched down hard, the situation becoming unrecoverable within seconds, followed by the aircraft impacting the ground. There were possibly ways to save the aircraft (reduce aerodynamic forces that prevented trim by hand by, for instance, reducing thrust), but those weren't detailed in any ADs. [1]https://leehamnews.com/wp-content/uploads/2019/04/Preliminary-Report-B737-800MAX-ET-AVJ.pdf https://leehamnews.com/wp-content/uploads/2019/04/Preliminar...
  - WalterBright 4y ago
    The instructions in the Emergency Airworthiness Directive said: 1. restore trim to normal with the electric thumb switches on the column 2. then turn off the stab trim The electric trim overrides MCAS. Boeing Emergency Airworthiness Directive: "Initially, higher control forces may be needed to overcome any stabilizer nose down trim already applied. Electric stabilizer trim can be used to neutralize control column pitch forces before moving the STAB TRIM CUTOUT switches to CUTOUT. Manual stabilizer trim can be used before and after the STAB TRIM CUTOUT switches are moved to CUTOUT." https://theaircurrent.com/wp-content/uploads/2018/11/B737-MAX-AD-1107.pdf https://theaircurrent.com/wp-content/uploads/2018/11/B737-MA...
    - chmod775 4y ago
      > 1. restore trim to normal with the electric thumb switches on the column That's probably not an easy thing with a computer undoing your work every few seconds and fighting you for control. And they did try to correct the trim before moving to 2. 5:40:00 AND (here automatic nose down) activates for 9 seconds, computer trimming from 4.60 to 2.1 units, crew trying to counteract by pitching up. 5:40:14 Pilot begins adjusting trim up. Gets to 2.4 units. 5:40:22 AND activates yet again (7s), also pushing trim all the way down to 0.4 units. DON'T SINK warning and PULL UP. 5:40:29 Captain asks the First-Officer to trim up with him. They reach 2.3 units (9s). This interrupts AND. 5:40:38 stab trim cut-out 5:40:43 AND activates again, but at least now it leaves the stabilizer alone. All in they did fine, considering all this happened in 40 seconds. They regained control of the aircraft and now have time to asses what even happened. However they still have to apply up to 100lbs of force to keep the nose somewhat pointed up. Only at times when both of them are actually pulling on the stick does the plane gain altitude. On top of that they're getting a MASTER CAUTION "anti-ice left alpha vane", adding to their workload. In the next three minutes they're discussing the warnings they're getting, informing ATC of their problem, and are trying to manually trim the plane (which doesn't work). I'd imagine their arms are getting tired. So the understandable next step is to switch stab trim cut out back to normal, then trying to correct the trim further. 5:43:11 stab trim back to normal, followed by some short manual electric trim inputs 5:43:21 AND triggers yet again (5s), stab to 1.0 units. Within the first 3.5s the aircraft pitches -8° down, descent rate increases to -5,000 ft/min. If they had caught and interrupted the AND/flipped stab trim back immediately, maybe this could've been saved. But since the computer got to do its thing for a few seconds, it's pretty much too late to do anything. The pilots are applying up to 180lbs of force, which accomplishes nothing. The plane keeps pitching further down. 5:43:44 Plane impacts the ground at an angle of 40° nose down. That whole timeline was 3 minutes, 44 seconds. The only way you can reasonably expect a human to deal with a situation like that, which requires a quick response, is if you train them for it. You don't just give a vague warning, a bunch of steps with three IFs attached, and hope for the best. More complete, interim, report: https://reports.aviation-safety.net/2019/20190310-0_B38M_ET-AVJ_Interim.pdf https://reports.aviation-safety.net/2019/20190310-0_B38M_ET-...
constantcrying 4y ago
>First the design of the software used in commercial airplanes is bat shit insane At least in that case. But it isn't normal that you blindly trust a sensor, not even Level D (failure is unimportant and easy to deal with) Software would/should do that. It actually takes a significant effort to put Software into a plane, which only increases with safety requirements. The chain of failure which needed to happen in this case is enormous. Dozens of people need to have looked at the documentation and nobody cared/figured out this blatant security issue. How can a company like Boeing even operate like that?
- CyanBird 4y ago
  > which only increases with safety requirements Yes, safety requirements which include the double buffer of two trained and experienced human pilots being in physical command of the plane double checking themselves and the software/hardware
  - constantcrying 4y ago
    >Yes, safety requirements which include the double buffer of two trained and experienced human pilots being in physical command of the plane double checking themselves and the software/hardware A lot of hardware/software is totally automatic and it would be insane if it were constantly checked by humans. Of course none of these systems running totally automatic have the ability to push thevplane into the ground based on faulty sensor data. My point was that the failure of the MCAS was institutional, you should not be able to bring software like that onto a plane. On the topic of the number of pilots my thoughts are that the redundancy is for the most part only neccessarry in exceptional situations. But exactly those situations are the ones in which the best thing a plane can usually do is graceful failure and handing control to the crew, which can far more easily overwhelm a single pilot.
    - WalterBright 4y ago
      > Of course none of these systems running totally automatic have the ability to push the plane into the ground based on faulty sensor data. The yaw damper does. There was another crash where the autothrottle was reading data from only one of the radio altimeters, which was giving false data. At 400ft altitude the autothrottle thought the airplane was landing, and pulled the throttles back to idle. The airplane pancaked into the ground. All avionics software that has control authority can crash the airplane. What was wrong with MCAS was its reliance on only one sensor, and no way to tell if the sensor was faulty. That's not an issue with the concept of MCAS.

by josefx 4y ago

WalterBright 4y ago

I know a bit about the MCAS disaster. Very few people know that there were *three* incidences of MCAS runaway trim. What happened with the third one (which was actually the first incident)? It didn't crash. The pilot just turned off the stab trim system. The override was there, it was always there. The thumb switches on the control column overrode it. Turning it off with the STAB TRIM CUTOFF switch turned it off. This procedure was detailed in an Emergency Airworthiness Directive issued to all 737MAX pilots after the first crash. The pilots in the second crash did not follow that procedure. The pilots of all three incidents used the thumb switches to override MCAS and restore normal trim. The first crew then turned off the trim and landed safely. The second crew never did turn off the trim and crashed. The third turned off the trim when the airplane was in a dive and could not recover.

kozak 4y ago
It is also interesting that in that third incident it was the presence of a THIRD pilot in the cockpit that helped to diagnose the problem.
bobkazamakis 4y ago
Huh, if only there could have been some kind of training that would be required to use this new system, but that would require recertification!
- thefounder 4y ago
  Or if this system wasn't so badly designed to require yet another training class.
- WalterBright 4y ago
  Pilots are already trained to turn off the STAB TRIM when it misbehaves. The switch to do it is prominent on the console for good reason.
chmod775 4y ago
> Turning it off with the STAB TRIM CUTOFF switch turned it off. > The pilots in the second crash did not follow that procedure. "At 05:40:35, the First-Officer called out 'stab trim cut-out' two times. Captain agreed and First-Officer confirmed stab trim cut-out."[1] However they were unable to correct the trim of the aircraft without help of the electrical systems (still being on full takeoff power didn't help). So around 3 minutes later stab trim cutout was switched back to normal. Pretty much the moment they did that the aircraft pitched down hard, the situation becoming unrecoverable within seconds, followed by the aircraft impacting the ground. There were possibly ways to save the aircraft (reduce aerodynamic forces that prevented trim by hand by, for instance, reducing thrust), but those weren't detailed in any ADs. [1]https://leehamnews.com/wp-content/uploads/2019/04/Preliminary-Report-B737-800MAX-ET-AVJ.pdf https://leehamnews.com/wp-content/uploads/2019/04/Preliminar...
- WalterBright 4y ago
  The instructions in the Emergency Airworthiness Directive said: 1. restore trim to normal with the electric thumb switches on the column 2. then turn off the stab trim The electric trim overrides MCAS. Boeing Emergency Airworthiness Directive: "Initially, higher control forces may be needed to overcome any stabilizer nose down trim already applied. Electric stabilizer trim can be used to neutralize control column pitch forces before moving the STAB TRIM CUTOUT switches to CUTOUT. Manual stabilizer trim can be used before and after the STAB TRIM CUTOUT switches are moved to CUTOUT." https://theaircurrent.com/wp-content/uploads/2018/11/B737-MAX-AD-1107.pdf https://theaircurrent.com/wp-content/uploads/2018/11/B737-MA...
  - chmod775 4y ago
    > 1. restore trim to normal with the electric thumb switches on the column That's probably not an easy thing with a computer undoing your work every few seconds and fighting you for control. And they did try to correct the trim before moving to 2. 5:40:00 AND (here automatic nose down) activates for 9 seconds, computer trimming from 4.60 to 2.1 units, crew trying to counteract by pitching up. 5:40:14 Pilot begins adjusting trim up. Gets to 2.4 units. 5:40:22 AND activates yet again (7s), also pushing trim all the way down to 0.4 units. DON'T SINK warning and PULL UP. 5:40:29 Captain asks the First-Officer to trim up with him. They reach 2.3 units (9s). This interrupts AND. 5:40:38 stab trim cut-out 5:40:43 AND activates again, but at least now it leaves the stabilizer alone. All in they did fine, considering all this happened in 40 seconds. They regained control of the aircraft and now have time to asses what even happened. However they still have to apply up to 100lbs of force to keep the nose somewhat pointed up. Only at times when both of them are actually pulling on the stick does the plane gain altitude. On top of that they're getting a MASTER CAUTION "anti-ice left alpha vane", adding to their workload. In the next three minutes they're discussing the warnings they're getting, informing ATC of their problem, and are trying to manually trim the plane (which doesn't work). I'd imagine their arms are getting tired. So the understandable next step is to switch stab trim cut out back to normal, then trying to correct the trim further. 5:43:11 stab trim back to normal, followed by some short manual electric trim inputs 5:43:21 AND triggers yet again (5s), stab to 1.0 units. Within the first 3.5s the aircraft pitches -8° down, descent rate increases to -5,000 ft/min. If they had caught and interrupted the AND/flipped stab trim back immediately, maybe this could've been saved. But since the computer got to do its thing for a few seconds, it's pretty much too late to do anything. The pilots are applying up to 180lbs of force, which accomplishes nothing. The plane keeps pitching further down. 5:43:44 Plane impacts the ground at an angle of 40° nose down. That whole timeline was 3 minutes, 44 seconds. The only way you can reasonably expect a human to deal with a situation like that, which requires a quick response, is if you train them for it. You don't just give a vague warning, a bunch of steps with three IFs attached, and hope for the best. More complete, interim, report: https://reports.aviation-safety.net/2019/20190310-0_B38M_ET-AVJ_Interim.pdf https://reports.aviation-safety.net/2019/20190310-0_B38M_ET-...

constantcrying 4y ago

>First the design of the software used in commercial airplanes is bat shit insane At least in that case. But it isn't normal that you blindly trust a sensor, not even Level D (failure is unimportant and easy to deal with) Software would/should do that. It actually takes a significant effort to put Software into a plane, which only increases with safety requirements. The chain of failure which needed to happen in this case is enormous. Dozens of people need to have looked at the documentation and nobody cared/figured out this blatant security issue. How can a company like Boeing even operate like that?

CyanBird 4y ago
> which only increases with safety requirements Yes, safety requirements which include the double buffer of two trained and experienced human pilots being in physical command of the plane double checking themselves and the software/hardware
- constantcrying 4y ago
  >Yes, safety requirements which include the double buffer of two trained and experienced human pilots being in physical command of the plane double checking themselves and the software/hardware A lot of hardware/software is totally automatic and it would be insane if it were constantly checked by humans. Of course none of these systems running totally automatic have the ability to push thevplane into the ground based on faulty sensor data. My point was that the failure of the MCAS was institutional, you should not be able to bring software like that onto a plane. On the topic of the number of pilots my thoughts are that the redundancy is for the most part only neccessarry in exceptional situations. But exactly those situations are the ones in which the best thing a plane can usually do is graceful failure and handing control to the crew, which can far more easily overwhelm a single pilot.
  - WalterBright 4y ago
    > Of course none of these systems running totally automatic have the ability to push the plane into the ground based on faulty sensor data. The yaw damper does. There was another crash where the autothrottle was reading data from only one of the radio altimeters, which was giving false data. At 400ft altitude the autothrottle thought the airplane was landing, and pulled the throttles back to idle. The airplane pancaked into the ground. All avionics software that has control authority can crash the airplane. What was wrong with MCAS was its reliance on only one sensor, and no way to tell if the sensor was faulty. That's not an issue with the concept of MCAS.