Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Lack of redundancies on Boeing 737 MAX baffles some involved in developing it

seattletimes.com

Post reply on HN
Print view View original

81–90 of 163 posts

Re: Lack of redundancies on Boeing 737 MAX baffles some involved in developing it

#81

Post by ishan1121 »

ptidhomme wrote: post #68
ishan1121 wrote: post #44

Earlier quoted context omitted.

The airline manufacturers have to push for automatic systems as they are the one of the features that sells. One of a close friend of mine who works at Airbus said that the company believes the next gen aircrafts would only require a single person in the cockpit, and everything will be handled through automations. Airbus aircrafts are more automated than Boeing. If Boeing does not work on the automation part, it coul…

Automation is not bad per se. What I mean is that there must be an opportunity for human override at all levels of automation (and as seamless as possible) in case of machine failure. It does not deny that it could be done by one pilot only, or half a pilot or even somehow a remote human intervention. When designing a critical system such as an aircraft, you must include human authority into it. No technology will ev…

>When designing a critical system such as an aircraft, you must include human authority into it

This is where Boeing messed up big time. According to the article they only had 2 AoA sensor, completely missing the fact that what happens if one sensor fails and which is correct. Airbus has 3, but IMO a critical component like an AoA sensor there should be 5 + additional inputs from the artificial horizon should be considered.

>You cannot design an unoverrideable automatic mechanism.

Yes, it makes sense. Even a complete automatic mechanism would need functionality to override in case things go completely haywire.

Re: Lack of redundancies on Boeing 737 MAX baffles some involved in developing it

#82

Post by iSnow »

crocal wrote: post #75
devit wrote: post #71

Earlier quoted context omitted.

How expensive are these sensors compared to the cost of the plane? Any reason to not just use at least 9 of them, pick the median value and forget about it?

Yes there is. If you put too many sensors then there is always one in need of repair. And then it becomes dangerous: the pilot and maintainer ignores the alarm, delay replacement, leading slowly to a failure. This is why the redundancy choices and availability calculations should always be made pondering the maintenance burden.

Well, I've been working in mass mobility and they had 4x redundancy with different sensor types. The more sensors went bad, the more restricted the operation regime became as it went through degraded modes. And the on-board systems were of course aware of the status of the sensors.

I think that created the right incentives: you could ignore a faulty sensor or two, but the results were increased travel times, so costs to the operator.

I always wonder why we don't have massive arrays of micro-sensors on planes spread out over the plane. If a handful your 65k sensors start to fail, you can delay repair for quite some time - otoh, if sensors start to fail all over the plane, you know you have to wake up the pilot hard, since it's a systemic problem like icing.

Re: Lack of redundancies on Boeing 737 MAX baffles some involved in developing it

#83

Post by cjbprime »

Aser wrote: post #64
cletus wrote: post #20

Earlier quoted context omitted.

Yep, 3 sensors can fail too. Less often however. These sensors exist to solve a problem with the MAX design. Changing and moving the engines increased the likelihood of a stall when the engines could push the nose up (as I understand it). Fine. But here's the kicker: this should be something that pilots should be trained on. They should be aware of how the MAX is different to the previous 737s and know what to do to…

The pilots were trained on how to deal with a runaway trim stabiliser. The procedure hasn't changed from the old 737, the only thing that has changed is that it is that the failure mode is more likely to occurr on the 737 MAX. From the article: “A properly trained pilot should be able to solve an MCAS anomaly or any uncommanded flight-control input through procedures that are taught to all 737 pilots,” said Menza, no…

It doesn't present as runaway trim, though. It's a small change in the trim, repeated every few seconds, which can be counteracted on the control column but will eventually add up. Small trim changes are usually happening all the time.

Re: Lack of redundancies on Boeing 737 MAX baffles some involved in developing it

#84

Post by cjbprime »

HlessClaudesman wrote: post #63

I'm gonna take a punt on the root cause of this mess: cost cutting / bonus seeking managerialisim. In my experience people high up in the decision chain with no technical expertise often have blind faith in what "technology" can accomplish.

For what it's worth, "take a punt on" means "avoid dealing with", which sounds like the opposite of your intent.

Re: Lack of redundancies on Boeing 737 MAX baffles some involved in developing it

#85

Post by iSnow »

golergka wrote: post #80
tomnm wrote: post #69

Earlier quoted context omitted.

I can't stop thinking whether similar "compromises" had been made when redesigning the airframe. It's engineering after all. The engineers could be pressed by the management to make certain changes for the sake of profit.

But managers rely on engineers to let them know when some compromise can be made and when it is absolutely vital not to do it.

But management also relies on customers to tell them which compromise is vital to selling a product. And in a market with such huge price-pressure as aeronautics, I can easily see how this is going to override engineer's concerns.

Re: Lack of redundancies on Boeing 737 MAX baffles some involved in developing it

#86

Post by crististm »

crocal wrote: post #79
crististm wrote: post #77

Earlier quoted context omitted.

I find it surprising when a system is considered "redundant" when the _pilot_ is part of redundancy!? If this is an accepted solution then it is very easy to be abused: sensors fail, never mind, pilot has eyes and can deactivate a malfunctioning _whatever_.

Depending on the mode of operation, the pilot will or will not be part of the redundancy. The trick in this type of application is the management of mode transitions. When sensors fail, the system will transition to degraded modes of operations where the pilot will have more responsibility. The safety case will rely on demonstrating that transition to such degraded modes is low enough to be compatible with the human…

I don't understand (all) your points.

I'm questioning whether a system as the one I described can be abused to the point where redundancy is offloaded to pilot flying the plane even when it shouldn't be?

Re: Lack of redundancies on Boeing 737 MAX baffles some involved in developing it

#87

Post by jackson1way »

I have a question since many years that I am afraid to ask so straight. There is the AF447 and those 2 Boeing MAX that I remember where people will always talk about redundancy of the sensors, or their maintenance.

But really, I want to know why the software and hardware of the aircraft fails to understand that whatever actions it has performed automatically or inputs/actions by the pilots, or any other important event, are making the damn aircraft loose altitude really really fast. In the case of these Boeings, how can your software keep pointing the nose of the aircraft down WHILE it is CONSISTENTLY loosing altitude? How is this not a huge design flaw? I understand that for stall recovery you actually have to loose some altitude to regain speed/lift and recover from the stall. But if you STILL KEEP loosing altitude and there is no turning point, then damnit, whatever caused the loosing altitude should be stopped at least at 500m AGL, no? Switch on a huge yellow light to the pilots „you are 100% on your own now, the computer is out of luck and is shutting down“ and the pilot jumps on the gas pedal, 200% power to the engines, and starts to figure out how to gain altitude. Both Boeing flights were in daylight, no? Pilots should be able to see the ground/water and be able to pull the thing back up just by visibility without any sensors? It‘s a bit of a different case with the AF447, though.

How did the AoA sensors and MCAS won the authority here over the only important data: altitude change. Who cares if the AoA shows 30 degrees or -271 degrees, as long as the plane is climbing we are good! No need to point the nose down or do any other stall protection stuff? And that seems to be really what happened with these 2 Boeings. They were climbing but some stupid AoA sensor failed and some even more stupid MCAS decided to dive. And they kept diving until they reached the ocean and MCAS was still confident it was a good idea to dive?

In some planes my iPhone is able to get the GPS reading and some free app I got 5 years ago will actually show me ground speed and altitude. Which I always find very exciting. It usually matches with what the entertainment system is showing on the pax screens. Give or take I hope I don‘t make it sound stupid or even i-know-it-better, but I really just want to understand.

Re: Lack of redundancies on Boeing 737 MAX baffles some involved in developing it

#88

Post by golergka »

iSnow wrote: post #85
golergka wrote: post #80

Earlier quoted context omitted.

But managers rely on engineers to let them know when some compromise can be made and when it is absolutely vital not to do it.

But management also relies on customers to tell them which compromise is vital to selling a product. And in a market with such huge price-pressure as aeronautics, I can easily see how this is going to override engineer's concerns.

I don't think that any Boeing customer have said or implied that it's OK if a plane can crash as long as they save up on pilot training.

Re: Lack of redundancies on Boeing 737 MAX baffles some involved in developing it

#89

Post by crocal »

crististm wrote: post #86
crocal wrote: post #79

Earlier quoted context omitted.

Depending on the mode of operation, the pilot will or will not be part of the redundancy. The trick in this type of application is the management of mode transitions. When sensors fail, the system will transition to degraded modes of operations where the pilot will have more responsibility. The safety case will rely on demonstrating that transition to such degraded modes is low enough to be compatible with the human…

I don't understand (all) your points. I'm questioning whether a system as the one I described can be abused to the point where redundancy is offloaded to pilot flying the plane even when it shouldn't be?

It can be abused, but it should not be possible if the process driving certification of such system is followed properly.

The standards define checks and balances designed precisely to detect such abuse. In particular, the pilot’s rate of error is quantified and it should not be possible to abuse it without going unnoticed.

Re: Lack of redundancies on Boeing 737 MAX baffles some involved in developing it

#90

Post by HlessClaudesman »

cjbprime wrote: post #84
HlessClaudesman wrote: post #63

I'm gonna take a punt on the root cause of this mess: cost cutting / bonus seeking managerialisim. In my experience people high up in the decision chain with no technical expertise often have blind faith in what "technology" can accomplish.

For what it's worth, "take a punt on" means "avoid dealing with", which sounds like the opposite of your intent.

I was more going for the "make a general guess / bet" kind of meaning, which is how the phrase is used today in England / Australia / New Zealand.

https://english.stackexchange.com/questions/20742/why-did-th...

Thanks for the heads up tho, I will retire it from my rhetorical toolkit in favor of something more universally understood.

Post reply on HN