191–200 of 269 posts
Earlier quoted context omitted.
It suggests that no LionAir crews knew how to handle this.
US pilots say they didn't either. The training wasn't out there.
Later, it quotes claims that it "isn't in the documentation".
I would consider that published, official checklists are the most imminently critical form of documentation.
Earlier quoted context omitted.
Actual instrument-rated pilot here. What people (including pilots) do under stress is resort to simple actions drilled in by training. That's why emergency procedure training is a major part of pilot training curriculum. What goes away first under stress is capability for complex reasoning, which is what one would need to figure out what the heck is going on and take appropriate action. In this case an a/c doing unco…
My question is why doesn't the "omg something is seriously fucked up give me manual control NOW" button disable the MCAS as well? That seems like a UX failure.
I expect this will be included in the accident report. Hopefully NTSB will conduct their own first hand interview with this pilot. (I can't think of why they wouldn't.)
Earlier quoted context omitted.
Actual instrument-rated pilot here. What people (including pilots) do under stress is resort to simple actions drilled in by training. That's why emergency procedure training is a major part of pilot training curriculum. What goes away first under stress is capability for complex reasoning, which is what one would need to figure out what the heck is going on and take appropriate action. In this case an a/c doing unco…
My question is why doesn't the "omg something is seriously fucked up give me manual control NOW" button disable the MCAS as well? That seems like a UX failure.
You could almost certainly disable just about anything by pulling the appropriate circuit breaker. You don't want to do that because the plane may be left in a state where you can't control it manually and you only have a few thousand feet of altitude to recover.
There are, in fact, two switches to turn off the electronic control of the horizontal stabilizer. The previous Lion Air crew used them after the pilot riding in the jumpseat went back and grabbed his copy of what I'd assume was the flight manual and had an ah-hah moment[1]. The flight 610 crew were pouring over something (quick reference handbook?) but didn't express any awareness of the stabilizer being trimmed[2].
Depending on how bad things got there are a few problems with this. First, electrically moving the stabilizer is much faster than moving it manually. MCAS can operate at two speeds, IIRC both are slower than the speed dictated by the buttons on the yoke (plus the buttons on the yoke will pause MCAS). But even MCAS will move the stabilizer much faster than a pilot could by cranking the manual wheels. I believe that moving the stabilizer from one extreme at the fastest speed to the other takes about a minute. You can find videos of the stabilizer mechanism on a 777 on youtube, it's just not something that's designed to move quickly.
The next problem is that if the stabilizer is pitched down sufficiently (perhaps by MCAS), your first instinct may be to pull back on the yoke (to move the elevator) to regain pitch. Well, once you've done that the aerodynamic forces may be such that you can't move the stabilizer into a nose up position until you let go of the yoke and let the plane pitch down further (Boeing references needing to unload the stabilizer in some documents). That's something you've gotta have cat-like reflexes for when you're already flying so low.
The really sad part is that the pilots could have disabled MCAS and retained electric control over the stabilizer by extending the flaps. But how are the pilots going to know this when Boeing refused to document anything?
0: http://avherald.com/h?article=419f2f9e
1: https://www.grid.id/read/04966850/deretan-kejanggalan-yang-d...
2: https://www.straitstimes.com/asia/se-asia/cockpit-voice-reco...
Earlier quoted context omitted.
> That's east to say from an armchair but on an aircraft everything is "safety critical" to some extent and you have to choose what gets redundancy. In flight entertainment, non-emergency lighting, food prep, &c aren't "safety critical" any more than the TVs in hospital rooms are. As a layman, I'd've imagined that all avionics and control surface control was redundant. Don't most large planes have redundant hydraulic…
But this isn't really "avionics and surface control" more than automatic lane keeping is a critical control system for the car. MCAS is a convenience feature that counteracts the plane's tendency to pitch up more than you want when climbing. Sure it can improve safety, so can lane keeping in a car. Neither are critical to operation. You can fly/drive perfectly safely without them so they need not be super hardened ag…
Even if we suppose that is true and a fair comparison (which I wouldn't), the way failure modes are handled is key. If there is uncertainty about the sensors that control the feature which controls the avionics the system needs to halt. This is like keeping the lane control active when the computer vision algorithm used to detect the lanes is uncertain about where the lane is. Chances are it'll steer you into the next available tree and kill you.
Smoke testing could have been performed such that all possible combinations of transducer input could be considered and evaluated thoroughly for closed-loop effect at runtime.
These types of integration tests should have been performed repeatedly, seemingly endlessly in the quest for bugs and analysis of the full spectrum of runtime results and effects.
In my experience in the software industry, I've always done this for applications that have infinitely more trivial effect and results than an airliner at altitude containing hundreds of souls.
One potential counterpart to the seemingly infinite greed we see exponentially increasing could be the old adage that karma is a bitch.
Earlier quoted context omitted.
My question is why doesn't the "omg something is seriously fucked up give me manual control NOW" button disable the MCAS as well? That seems like a UX failure.
Could be related to the issue that MAX is unstable in flight with that system off. Unlike previous 737s.
The saddest thing, as many HN users should know all to well, is that there can be no excuse for automated systems like airliners to experience catastrophic failure and loss of life, if only due to the availability and application of modern SDLC principles and CI/CD etc. Smoke testing could have been performed such that all possible combinations of transducer input could be considered and evaluated thoroughly for clos…
Yes, you can test control loops -- you can even turn it into a unit test. At least in theory.
The problem is that to do the test you need either a working, physical system or a good model. So if you're making a shutdown valve for a chemical plant, you need a physical build of that control valve. Even on that scale, you're talking about something that could potentially fill an engineering lab, be quite noisy and have a considerable amount of stored pneumatic or hydraulic energy. It's possible, but not exactly practical.
The alternative is to model the system, but now the question changes: how can you be certain that your model is accurate and models all the variables? Say your valve is slower when it's cold and you don't model that -- now you have a false positive result ("it works" -- but nobody realised that "temperature" was a dependent variable).
So you take the middle ground - you can have the test jig for a week, so you record the inputs and outputs for a week under varying software conditions. But those recordings are only valid for that specific timing -- if you change the software and change the timing (maybe you move the trim motor slower), you get a model change and a false positive or negative.
It's certainly possible, but it's only possible with a good sized team, and supportive management who realise that the test is absolutely necessary.
Earlier quoted context omitted.
Can you explain how they are different? Both cause the stabilizer to tilt. Both cause the stabilizer wheels next to the pilot/co-pilot to turn. If the plane is pitching down, and you pull back the yoke and that still doesn't recover, don't you at some point check the stabilizer angle? If it's wrong, you use the stabilizer trim switch on the yoke under your thumb to correct it. Won't you see the stabilizer wheel turn…
Runaway stabilizer causes a more dramatic sudden movement than MCAS. MCAS's start, wait 5 seconds, re-start, motion is more gradual. For example you could look at the wheel and it has stopped, only to re-start after you look away (add noise cancelling Bose headphones and you may not hear it) Pilots are trained well for runaway stabilizer, MCAS was essentially the same thing, but it didn't FEEL like the same thing, so…
Besides obviously making the sensors used by MCAS truely redundant and limiting its extreme behavior of moving the trim up to the stops, a large part of fixing the MAX might be just having a big warning light for MCAS operating.