Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Lack of redundancies on Boeing 737 MAX baffles some involved in developing it

seattletimes.com

Post reply on HN
Print view View original

11–20 of 163 posts

Re: Lack of redundancies on Boeing 737 MAX baffles some involved in developing it

#11

Post by danaliv »

dragonsky67 wrote: post #8
js2 wrote: post #2

Despite the headline, the article ends with: That triple-sensor system isn’t foolproof, however. In 2008, on a customer-acceptance flight of an Airbus A320, two of the angle-of-attack sensors froze and those two sensors then outvoted the third. When the pilots went to demonstrate the stall-prevention system, they were not aware of the malfunctioning sensors. The plane crashed, killing the seven people on board. The s…

If there are three of the same type (make/model?) of sensor teaming to vote on the status being measured I'm not suprised that they can suffer the same failure (iceing) at the same time causing an incorrect state to be upvoted. I would have thought that for any condition there would be more than one mechanism available to sense it. You could get different devices to vote on what is the real condition. This has been d…

Are you talking about a turn coordinator? That doesn't show "down." The sum of forces acting in a coordinated turn will keep the ball centered even though the airplane is banked.

Also I'm not sure what you're talking about with using the real horizon as a backup to the artificial horizon. It's not meant to be a redundant setup. Artificial horizons aren't required for visual (looking outside) flight, and relying primarily on the instruments in visual flight is an error.

In clouds/poor visibility, the cross-check for the artificial horizon is provided by the other flight instruments: airspeed, altimeter, turn coordinator, vertical speed indicator, and directional gyro (or their equivalents on an electronic display).

Re: Lack of redundancies on Boeing 737 MAX baffles some involved in developing it

#12

Post by [deleted] »

argd678 wrote: post #4
js2 wrote: post #2

Despite the headline, the article ends with: That triple-sensor system isn’t foolproof, however. In 2008, on a customer-acceptance flight of an Airbus A320, two of the angle-of-attack sensors froze and those two sensors then outvoted the third. When the pilots went to demonstrate the stall-prevention system, they were not aware of the malfunctioning sensors. The plane crashed, killing the seven people on board. The s…

It does seem like a primitive system to use the wind for AoA, seems like there should be better and more reliable ways to determine it. Update: AoA not AoT

[deleted]

Re: Lack of redundancies on Boeing 737 MAX baffles some involved in developing it

#13

Post by sollibro »

argd678 wrote: post #4
js2 wrote: post #2

Despite the headline, the article ends with: That triple-sensor system isn’t foolproof, however. In 2008, on a customer-acceptance flight of an Airbus A320, two of the angle-of-attack sensors froze and those two sensors then outvoted the third. When the pilots went to demonstrate the stall-prevention system, they were not aware of the malfunctioning sensors. The plane crashed, killing the seven people on board. The s…

It does seem like a primitive system to use the wind for AoA, seems like there should be better and more reliable ways to determine it. Update: AoA not AoT

Is there another method to measure wind direction, that doesn't involve a small physical winglet?

Re: Lack of redundancies on Boeing 737 MAX baffles some involved in developing it

#14

Post by WalterBright »

leggomylibro wrote: post #10
js2 wrote: post #2

Despite the headline, the article ends with: That triple-sensor system isn’t foolproof, however. In 2008, on a customer-acceptance flight of an Airbus A320, two of the angle-of-attack sensors froze and those two sensors then outvoted the third. When the pilots went to demonstrate the stall-prevention system, they were not aware of the malfunctioning sensors. The plane crashed, killing the seven people on board. The s…

Triple-redundancy isn't 100% foolproof, but it is a lot better than two potentially-faulty sensors. I know this isn't a great example, but triple redundancy is enough of a design cornerstone that Arthur C. Clarke made it one of the defining features of Rendezvous With Rama , a classic sci-fi story about an Oumuamua-like object that people manage to land on: >It was now strikingly apparent that the "city", like so muc…

The problem with this idea is the "identical" aspect of each redundancy. If it's identical, then it will likely suffer from the same failure mode at the same time as the others. In the case of the AoA freezing, that's exactly what happened.

A more robust idea is to have three redundant subsystems, each different.

Re: Lack of redundancies on Boeing 737 MAX baffles some involved in developing it

#15

Post by leggomylibro »

WalterBright wrote: post #14
leggomylibro wrote: post #10

Earlier quoted context omitted.

Triple-redundancy isn't 100% foolproof, but it is a lot better than two potentially-faulty sensors. I know this isn't a great example, but triple redundancy is enough of a design cornerstone that Arthur C. Clarke made it one of the defining features of Rendezvous With Rama , a classic sci-fi story about an Oumuamua-like object that people manage to land on: >It was now strikingly apparent that the "city", like so muc…

The problem with this idea is the "identical" aspect of each redundancy. If it's identical, then it will likely suffer from the same failure mode at the same time as the others. In the case of the AoA freezing, that's exactly what happened. A more robust idea is to have three redundant subsystems, each different.

Yeah, but I get the feeling that it's more of a way to ensure that you probably get at least two components that will 'burn in' well and hopefully not fail too early:

https://en.wikipedia.org/wiki/Bathtub_curve

Like, you don't expect them to last forever, but you do expect at least 2/3 to meet their lifetime estimates.

Re: Lack of redundancies on Boeing 737 MAX baffles some involved in developing it

#16

Post by WalterBright »

sollibro wrote: post #13
argd678 wrote: post #4

Earlier quoted context omitted.

It does seem like a primitive system to use the wind for AoA, seems like there should be better and more reliable ways to determine it. Update: AoA not AoT

Is there another method to measure wind direction, that doesn't involve a small physical winglet?

Another way would be to stick a tab in the slipstream, and measure the pressure on its leading edge and both sides. Or just put a strain gauge on the mount of the tab and measure the bending forces (and this would have no ports to freeze or moving parts to jam). I bet there are lots of ways.

P.S. I bet you could even put a strain gauge on the wing spar to measure the bending force on the wing, couple that with other inputs like airspeed, and come up with a reasonable AoA value.

Re: Lack of redundancies on Boeing 737 MAX baffles some involved in developing it

#17

Post by deathanatos »

leggomylibro wrote: post #15
WalterBright wrote: post #14

Earlier quoted context omitted.

The problem with this idea is the "identical" aspect of each redundancy. If it's identical, then it will likely suffer from the same failure mode at the same time as the others. In the case of the AoA freezing, that's exactly what happened. A more robust idea is to have three redundant subsystems, each different.

Yeah, but I get the feeling that it's more of a way to ensure that you probably get at least two components that will 'burn in' well and hopefully not fail too early: https://en.wikipedia.org/wiki/Bathtub_curve Like, you don't expect them to last forever, but you do expect at least 2/3 to meet their lifetime estimates.

I don't think it's so much about the lifetime of the component, or whether it eventually fails due to faulty manufacturing or gradual wear and tear. (What the bathtub curve gets at.)

It's that if you do make parts that are identical, and you expose them to identical unanticipated circumstances, they're likely to behave identically, and fail identically.

I've seen this w/ distributed databases. I overloaded a Cassandra instance once, causing it to OOM. That node failed, but it's distributed, so another node automatically took over, ran the same query, and OOMed, and then the last guy took the query, and very quickly I had 3 dead nodes.

Re: Lack of redundancies on Boeing 737 MAX baffles some involved in developing it

#18

Post by WalterBright »

leggomylibro wrote: post #15
WalterBright wrote: post #14

Earlier quoted context omitted.

The problem with this idea is the "identical" aspect of each redundancy. If it's identical, then it will likely suffer from the same failure mode at the same time as the others. In the case of the AoA freezing, that's exactly what happened. A more robust idea is to have three redundant subsystems, each different.

Yeah, but I get the feeling that it's more of a way to ensure that you probably get at least two components that will 'burn in' well and hopefully not fail too early: https://en.wikipedia.org/wiki/Bathtub_curve Like, you don't expect them to last forever, but you do expect at least 2/3 to meet their lifetime estimates.

I once had a discussion with a scifi author about how to design a starship to last a long time. I suggested that it being repairable would be of paramount importance. To that end, the various systems should use interchangeable parts. Starting with the obvious like nuts&bolts should be standardized, extend that to things like computer boards and components, motors, etc.

For example, if you had a linux machine running the fusion drive, and a mac machine running the entertainment arcade, and the linux machine shorted out, it would sure suck if you couldn't cannibalize the entertainment arcade computer to fix it.

It goes back to Apollo 13, where the CO2 scrubbers on the command module were a different design than the ones on the lunar module, which inhibited them being able to refresh the ones on the lem, and nearly caused loss of the crew.

Re: Lack of redundancies on Boeing 737 MAX baffles some involved in developing it

#19

Post by WalterBright »

deathanatos wrote: post #17
leggomylibro wrote: post #15

Earlier quoted context omitted.

Yeah, but I get the feeling that it's more of a way to ensure that you probably get at least two components that will 'burn in' well and hopefully not fail too early: https://en.wikipedia.org/wiki/Bathtub_curve Like, you don't expect them to last forever, but you do expect at least 2/3 to meet their lifetime estimates.

I don't think it's so much about the lifetime of the component, or whether it eventually fails due to faulty manufacturing or gradual wear and tear. (What the bathtub curve gets at.) It's that if you do make parts that are identical, and you expose them to identical unanticipated circumstances, they're likely to behave identically, and fail identically. I've seen this w/ distributed databases. I overloaded a Cassandr…

This is especially true with software. Having identical software in the backup means it'll seg fault too.

Re: Lack of redundancies on Boeing 737 MAX baffles some involved in developing it

#20

Post by cletus »

js2 wrote: post #2

Despite the headline, the article ends with: That triple-sensor system isn’t foolproof, however. In 2008, on a customer-acceptance flight of an Airbus A320, two of the angle-of-attack sensors froze and those two sensors then outvoted the third. When the pilots went to demonstrate the stall-prevention system, they were not aware of the malfunctioning sensors. The plane crashed, killing the seven people on board. The s…

Yep, 3 sensors can fail too. Less often however.

These sensors exist to solve a problem with the MAX design. Changing and moving the engines increased the likelihood of a stall when the engines could push the nose up (as I understand it). Fine.

But here's the kicker: this should be something that pilots should be trained on. They should be aware of how the MAX is different to the previous 737s and know what to do to disable this system if it causes problems.

But that might be the end of a common type rating, which is something the airlines (and apparently Boeing) didn't want.

The whole 737 MAX situation just looks like a giant clusterf--- that was a kneejerk reaction to the unexpected success of the A320neo to which Boeing had no answer and to avoid years-long development delays and losing more customers to Airbus, it really looks like they made shortcuts. And that's so damaging to their brand it really defies belief.

Post reply on HN