Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Lack of redundancies on Boeing 737 MAX baffles some involved in developing it

seattletimes.com

Post reply on HN
Print view View original

71–80 of 163 posts

Re: Lack of redundancies on Boeing 737 MAX baffles some involved in developing it

#71

Post by devit »

crocal wrote: post #61

I am a designer and implementor of vital speed and distance measurement systems, with triply modular redundancy, used in mass transit application. I cannot even imagine what the designers of this thing are going through now. It must be terrible. To make it worse, it's a confusing topic. There are two pillars to the design of such system. 1. Faulty sensor must be detected with a very high probability. The typical way…

How expensive are these sensors compared to the cost of the plane?

Any reason to not just use at least 9 of them, pick the median value and forget about it?

Re: Lack of redundancies on Boeing 737 MAX baffles some involved in developing it

#72

Post by magicalhippo »

js2 wrote: post #2

Despite the headline, the article ends with: That triple-sensor system isn’t foolproof, however. In 2008, on a customer-acceptance flight of an Airbus A320, two of the angle-of-attack sensors froze and those two sensors then outvoted the third. When the pilots went to demonstrate the stall-prevention system, they were not aware of the malfunctioning sensors. The plane crashed, killing the seven people on board. The s…

Couldn't one detect the frozen ones by simply noticing the loss of noise in the readings? I imagine an AoA sensor functioning normally to have a small amount of variation between readings due to turbulent air etc.

Alternatively, couldn't one correlate the AoA sensor output with the accelerometer output (or some other pitch sensor)? A frozen AoA would have identical readings as the plane changes pitch, a functioning one shouldn't, no?

Re: Lack of redundancies on Boeing 737 MAX baffles some involved in developing it

#73

Post by consto »

devit wrote: post #71
crocal wrote: post #61

I am a designer and implementor of vital speed and distance measurement systems, with triply modular redundancy, used in mass transit application. I cannot even imagine what the designers of this thing are going through now. It must be terrible. To make it worse, it's a confusing topic. There are two pillars to the design of such system. 1. Faulty sensor must be detected with a very high probability. The typical way…

How expensive are these sensors compared to the cost of the plane? Any reason to not just use at least 9 of them, pick the median value and forget about it?

It's incredibly unlikely, but not entirely unforseeable that enough sensors would fail at the same time for the same reason. All four engines on the 747 BA9 failed at the same time due to volcanic ash [0]. If you just take the median of nine, it's possible that a mere five failed sensors could break MCAS. And then you are back to the issue of handing over to the pilots.

[0] https://en.m.wikipedia.org/wiki/British_Airways_Flight_9

Re: Lack of redundancies on Boeing 737 MAX baffles some involved in developing it

#74

Post by jamesharding »

cm2187 wrote: post #62
netsharc wrote: post #60

Earlier quoted context omitted.

IMO pilots are there in case shit really hits the fan, or birds hit the turbofans: I doubt computers would be creative enough like Sullenberger and decide to land on a river. And 2 pilots means 2 brains that can divide the workload...

Fair point, but even then you could have a remote pilot telling the plane what to do with the automation executing the strategy (given the latency).

If the remote ground-based pilot has the capability to take total control authority of the aircraft (which, after the GermanWings incident would seem to be a necessity), then the security implications are massive. Imagine a remote-control attack on an aircraft carrying 800+ passengers...

https://en.wikipedia.org/wiki/Iran%E2%80%93U.S._RQ-170_incid...

Re: Lack of redundancies on Boeing 737 MAX baffles some involved in developing it

#75

Post by crocal »

devit wrote: post #71
crocal wrote: post #61

I am a designer and implementor of vital speed and distance measurement systems, with triply modular redundancy, used in mass transit application. I cannot even imagine what the designers of this thing are going through now. It must be terrible. To make it worse, it's a confusing topic. There are two pillars to the design of such system. 1. Faulty sensor must be detected with a very high probability. The typical way…

How expensive are these sensors compared to the cost of the plane? Any reason to not just use at least 9 of them, pick the median value and forget about it?

Yes there is. If you put too many sensors then there is always one in need of repair. And then it becomes dangerous: the pilot and maintainer ignores the alarm, delay replacement, leading slowly to a failure.

This is why the redundancy choices and availability calculations should always be made pondering the maintenance burden.

Re: Lack of redundancies on Boeing 737 MAX baffles some involved in developing it

#76

Post by nindalf »

crocal wrote: post #61

I am a designer and implementor of vital speed and distance measurement systems, with triply modular redundancy, used in mass transit application. I cannot even imagine what the designers of this thing are going through now. It must be terrible. To make it worse, it's a confusing topic. There are two pillars to the design of such system. 1. Faulty sensor must be detected with a very high probability. The typical way…

> even worse, not exported to the training material of the pilots

According to this article (https://www.vox.com/business-and-finance/2019/3/29/18281270/...), this was a requirement of the 737-MAX while it was being developed. It needed to be sold as pretty much the same as it's predecessors, therefore requiring minimal retraining.

> The training piece is important because a key selling feature of the 737 Max was the idea that since it wasn’t really a new plane, pilots didn’t really need to be retrained for the new equipment. As the New York Times reported, “For many new airplane models, pilots train for hours on giant, multimillion-dollar machines, on-the-ground versions of cockpits that mimic the flying experience and teach them new features” while the experienced 737 Max pilots were allowed light refresher courses that you could do on an iPad.

> That let Boeing get the planes into customers’ hands quickly and cheaply, but evidently at the cost of increasing the possibility of pilots not really knowing how to handle the planes, with dire consequences for everyone involved.

Re: Lack of redundancies on Boeing 737 MAX baffles some involved in developing it

#77

Post by crististm »

crocal wrote: post #61

I am a designer and implementor of vital speed and distance measurement systems, with triply modular redundancy, used in mass transit application. I cannot even imagine what the designers of this thing are going through now. It must be terrible. To make it worse, it's a confusing topic. There are two pillars to the design of such system. 1. Faulty sensor must be detected with a very high probability. The typical way…

I find it surprising when a system is considered "redundant" when the _pilot_ is part of redundancy!? If this is an accepted solution then it is very easy to be abused: sensors fail, never mind, pilot has eyes and can deactivate a malfunctioning _whatever_.

Re: Lack of redundancies on Boeing 737 MAX baffles some involved in developing it

#78

Post by chaosprophet »

josteink wrote: post #54
j16sdiz wrote: post #50

Earlier quoted context omitted.

New overriding scheme means more training. The selling point of 737MAX is any 737 pilot can fly on it without new training.

That was the selling point, yes, but it doesn’t seem to be quite true in real life. So if they can’t hold that promise anyway, why not provide a better interface?

Because if they didn't pretend that it was the same to fly a 737 and a 737 max, then they would be required to have pilots get a separate type certification for the max, which is costly for airlines and makes the airlines very reluctant to order the max.

Re: Lack of redundancies on Boeing 737 MAX baffles some involved in developing it

#79

Post by crocal »

crististm wrote: post #77
crocal wrote: post #61

I am a designer and implementor of vital speed and distance measurement systems, with triply modular redundancy, used in mass transit application. I cannot even imagine what the designers of this thing are going through now. It must be terrible. To make it worse, it's a confusing topic. There are two pillars to the design of such system. 1. Faulty sensor must be detected with a very high probability. The typical way…

I find it surprising when a system is considered "redundant" when the _pilot_ is part of redundancy!? If this is an accepted solution then it is very easy to be abused: sensors fail, never mind, pilot has eyes and can deactivate a malfunctioning _whatever_.

Depending on the mode of operation, the pilot will or will not be part of the redundancy. The trick in this type of application is the management of mode transitions.

When sensors fail, the system will transition to degraded modes of operations where the pilot will have more responsibility.

The safety case will rely on demonstrating that transition to such degraded modes is low enough to be compatible with the human rate of errors.

A modern system should not be declared safe if it relies on pilot _whatever_.

Not sayin’ it did not happen in the past. Unfortunately.

Re: Lack of redundancies on Boeing 737 MAX baffles some involved in developing it

#80

Post by golergka »

tomnm wrote: post #69
j16sdiz wrote: post #50

Earlier quoted context omitted.

New overriding scheme means more training. The selling point of 737MAX is any 737 pilot can fly on it without new training.

I can't stop thinking whether similar "compromises" had been made when redesigning the airframe. It's engineering after all. The engineers could be pressed by the management to make certain changes for the sake of profit.

But managers rely on engineers to let them know when some compromise can be made and when it is absolutely vital not to do it.
Post reply on HN