Lack of redundancies on Boeing 737 MAX baffles some involved in developing it • Hacker News Board

Re: Lack of redundancies on Boeing 737 MAX baffles some involved in developing it

#21

Post by xiphias2 » Wed, Apr 03, 2019, 4:54 AM UTC

cletus wrote: post #20

js2 wrote: post #2

Despite the headline, the article ends with: That triple-sensor system isn’t foolproof, however. In 2008, on a customer-acceptance flight of an Airbus A320, two of the angle-of-attack sensors froze and those two sensors then outvoted the third. When the pilots went to demonstrate the stall-prevention system, they were not aware of the malfunctioning sensors. The plane crashed, killing the seven people on board. The s…

Yep, 3 sensors can fail too. Less often however. These sensors exist to solve a problem with the MAX design. Changing and moving the engines increased the likelihood of a stall when the engines could push the nose up (as I understand it). Fine. But here's the kicker: this should be something that pilots should be trained on. They should be aware of how the MAX is different to the previous 737s and know what to do to…

I was hoping to have the damage in the Boing brand reflected more significantly in the share prices.

Re: Lack of redundancies on Boeing 737 MAX baffles some involved in developing it

#22

Post by adrianN » Wed, Apr 03, 2019, 5:11 AM UTC

WalterBright wrote: post #18

leggomylibro wrote: post #15

Earlier quoted context omitted.

Yeah, but I get the feeling that it's more of a way to ensure that you probably get at least two components that will 'burn in' well and hopefully not fail too early: https://en.wikipedia.org/wiki/Bathtub_curve Like, you don't expect them to last forever, but you do expect at least 2/3 to meet their lifetime estimates.

I once had a discussion with a scifi author about how to design a starship to last a long time. I suggested that it being repairable would be of paramount importance. To that end, the various systems should use interchangeable parts. Starting with the obvious like nuts&bolts should be standardized, extend that to things like computer boards and components, motors, etc. For example, if you had a linux machine running…

It's the same for software. Software that's supposed to be used "forever" should be written such that parts of it can be easily replaced. Highly flexible designs often lose against simpler designs because it's easier to rewrite the latter and very hard to change something when you bump against the limits of flexibility in the former.

Re: Lack of redundancies on Boeing 737 MAX baffles some involved in developing it

#23

Post by dragonsky67 » Wed, Apr 03, 2019, 5:17 AM UTC

danaliv wrote: post #11

dragonsky67 wrote: post #8

Earlier quoted context omitted.

If there are three of the same type (make/model?) of sensor teaming to vote on the status being measured I'm not suprised that they can suffer the same failure (iceing) at the same time causing an incorrect state to be upvoted. I would have thought that for any condition there would be more than one mechanism available to sense it. You could get different devices to vote on what is the real condition. This has been d…

Are you talking about a turn coordinator? That doesn't show "down." The sum of forces acting in a coordinated turn will keep the ball centered even though the airplane is banked. Also I'm not sure what you're talking about with using the real horizon as a backup to the artificial horizon. It's not meant to be a redundant setup. Artificial horizons aren't required for visual (looking outside) flight, and relying prima…

The point is that you are using a different type of device to cross check the reading from the first. In the case of the faulty sensor, it sounds like they are using the same type of device therefore conditions that impact the effectiveness of that device will likely impact more than one of them.

Re: Lack of redundancies on Boeing 737 MAX baffles some involved in developing it

#24

Post by dingaling » Wed, Apr 03, 2019, 5:21 AM UTC

brokenmachine wrote: post #3

js2 wrote: post #2

Despite the headline, the article ends with: That triple-sensor system isn’t foolproof, however. In 2008, on a customer-acceptance flight of an Airbus A320, two of the angle-of-attack sensors froze and those two sensors then outvoted the third. When the pilots went to demonstrate the stall-prevention system, they were not aware of the malfunctioning sensors. The plane crashed, killing the seven people on board. The s…

They need triple temperature sensors on those sensors to sense when they freeze...

Although you're being facetious, AoA sensors do have self-diagnostics that determine when their heating elements have failed.

Incodentally on the A380 and A350 Airbus have changed to combined AoA-pitot sensors of which there are now four.

Re: Lack of redundancies on Boeing 737 MAX baffles some involved in developing it

#25

Post by jdc » Wed, Apr 03, 2019, 5:22 AM UTC

xiphias2 wrote: post #21

cletus wrote: post #20

Earlier quoted context omitted.

Yep, 3 sensors can fail too. Less often however. These sensors exist to solve a problem with the MAX design. Changing and moving the engines increased the likelihood of a stall when the engines could push the nose up (as I understand it). Fine. But here's the kicker: this should be something that pilots should be trained on. They should be aware of how the MAX is different to the previous 737s and know what to do to…

I was hoping to have the damage in the Boing brand reflected more significantly in the share prices.

Maybe the problem hasn't been shouted from a high enough rooftop yet.

Re: Lack of redundancies on Boeing 737 MAX baffles some involved in developing it

#26

Post by hairytrog » Wed, Apr 03, 2019, 5:28 AM UTC

The only way to be 100% safe and 100% fool proof is to not fly. For a mechanical system as complex as an airplane, triple redundancy with a good pilot is pretty much the best you can hope for.

Re: Lack of redundancies on Boeing 737 MAX baffles some involved in developing it

#27

Post by bdamm » Wed, Apr 03, 2019, 5:29 AM UTC

jdc wrote: post #25

xiphias2 wrote: post #21

Earlier quoted context omitted.

I was hoping to have the damage in the Boing brand reflected more significantly in the share prices.

Maybe the problem hasn't been shouted from a high enough rooftop yet.

Or more likely it doesn't really matter, and in a couple years nobody will really remember this about Boeing. They'll go back to being a big airplane producer that has a stunning safety record, which they are despite this issue.

Re: Lack of redundancies on Boeing 737 MAX baffles some involved in developing it

#28

Post by dingaling » Wed, Apr 03, 2019, 5:36 AM UTC

WalterBright wrote: post #16

sollibro wrote: post #13

Earlier quoted context omitted.

Is there another method to measure wind direction, that doesn't involve a small physical winglet?

Another way would be to stick a tab in the slipstream, and measure the pressure on its leading edge and both sides. Or just put a strain gauge on the mount of the tab and measure the bending forces (and this would have no ports to freeze or moving parts to jam). I bet there are lots of ways. P.S. I bet you could even put a strain gauge on the wing spar to measure the bending force on the wing, couple that with other…

The problem with such approaches is that you have to model all the environmental and performance factors that could cause an identical pseudo-AoA to be calculated, in all flight modes. And to do that you need a range of sensors, all redundant... so now you need additional input validation and sanitisation.

For example, measuring slipstream over the wing is not sufficient. You need to known the pressure ratio between above and below, so there's two sensors. But airflow over a wing is not contiguous or straight, so you need more spanwise sensors to start averaging. And the inboard wing will stall first and give erroneous data, so you need to detect that and disregard it...

Rather than just measuring the raw value at source.

Re: Lack of redundancies on Boeing 737 MAX baffles some involved in developing it

#29

Post by 4sak3n » Wed, Apr 03, 2019, 5:53 AM UTC

"Two is one and one is none."

That's pretty much been aeronautical gospel since dinosaurs strapped cardboard to their stubby arms and dreamed of soaring.

Re: Lack of redundancies on Boeing 737 MAX baffles some involved in developing it

#30

Post by inamberclad » Wed, Apr 03, 2019, 5:56 AM UTC

taneq wrote: post #7

js2 wrote: post #2

Despite the headline, the article ends with: That triple-sensor system isn’t foolproof, however. In 2008, on a customer-acceptance flight of an Airbus A320, two of the angle-of-attack sensors froze and those two sensors then outvoted the third. When the pilots went to demonstrate the stall-prevention system, they were not aware of the malfunctioning sensors. The plane crashed, killing the seven people on board. The s…

I've had to do a bit of functional safety stuff recently and one of the things they focus on are "common cause failures" (of which this is a perfect example - if one of the sensors freezes, the others are likely to do so as well). If you want to be sure something works, it's not enough to just have two or three copies of the same system. You have to have redundancy in manner of operation as well.

To be specific, I'd call that functional redundancy, versus hardware redundancy. Be able to get the same thing done in different ways.

NASA's Genesis mission was bit by this a while back. It had redundant parachute sequencers for a sample return capsule, but they were all assembled identically and with the G-sensors backwards. Consequently, they all failed in exactly the same way.