Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Boeing 737 MAX crash and the rejection of ridiculous data

philip.greenspun.com

Post reply on HN
Print view View original

111–120 of 194 posts

Re: Boeing 737 MAX crash and the rejection of ridiculous data

#111

Post by scarhill »

sk5t wrote: post #85
js2 wrote: post #19

Earlier quoted context omitted.

Philip Greenspun is a highly experienced pilot: https://philip.greenspun.com/flying/milestones

Honest question, is his experience in small aircraft applicable at all to jetliners? How much carryover, beyond core theory of flight dynamics, is there from piloting a single prop to an Airbus or even a regional jet?

His resume includes:

- FAA ATP AMEL and ASEL certificate with CL-65 SIC rating and Part 121 experience; CE-510S rating (single pilot, Cessna Mustang)

- Helicopter ATP

- single-engine seaplane rating at the commercial level

- FAA Flight Instructor certificate with airplane single-engine, airplane multi-engine, helicopter, instrument airplane, and instrument helicopter ratings

He has also worked as a commercial pilot for Delta/Comair. See https://philip.greenspun.com/flying/resume

Re: Boeing 737 MAX crash and the rejection of ridiculous data

#112

Post by kgilpin »

Assuming that there are many software subsystems that need angle of attack input, it shouldn't be the responsibility of every one of those systems to try and determine if they are receiving bad input from the AOA indicator. Rather, there should be one angle of attack (AOA) sensing software system which feeds AOA data into all the other dependent systems. If the AOA sensing software system cannot determine a reliable value, then it should feed a value of "I don't know" to the downstream subsystems.

Then, all possible expertise about how to determine if the AOA input is valid (and I'm sure there are many, many, such factors, redundant physical sensors being just one) can be directed to that one AOA sensing system.

If MCAS gets an input of "I don't know" from the AOA sensing system, then clearly it is going to disable itself. So, a complex decision has been turned into a very simple one.

If you agree with me, then this is a really important example of why separation of concerns is so important.

Re: Boeing 737 MAX crash and the rejection of ridiculous data

#113

Post by linuxftw »

dramm wrote: post #104
linuxftw wrote: post #4

Do we actually have the raw data from the sensor in the flight recorder, or do we have the flight computer's account of that sensor's data? > IF AOA > 15 AND AOA And if the AOA is frozen at 16 due to some fault? What is a loss of signal interpreted as? Does it use last-known value? 0? 100? How often does the AOA get sampled? Is there any attempt to smooth the data? Was the data corrupted (bit errors) during transmiss…

You seem to be arguing multiple sides here. Philip Greenspun's speculation is a plausible concern, that is all it needs to be a valuable point, that type of data limit handling ought to be considered as the system is looked at. I read his post that he was talking a specific simple example, all the other types of things you mention could also be looked at. How the AoA sensors failed, any potential issues with signal h…

From the article:

> all of the problems could potentially have been avoided by changing [code-snippet]

IMO, this implies the problem was a simple, single software problem. Firstly, that's in inaccurate assumption. Secondly, even if that assumption wasn't implied, one can't just say 'ooh, modify this if statement' with any authority because one does't know what the underlying algorithm looks like in the first place.

> The system as implemented could not have a "re-command full-nose down after reset".

For brevity, my comment lacked certain detail. The MCAS system was reset after pilots used the trim switches on the column. However, the MCAS did not account for this, and it's overall authority was allowed to point the plane full nose-down. See [1].

> In my view when a seemingly largely self-regulated group goes off and designs something with so many glaring issues

This is the point I'm mostly trying to make. When I read a column or comment that says "Oh, it was just the sensors" or "Oh, it was just the simple software problem," that's really helping Boeing's narrative. It's not just a simple mistake, it's a total failure of Boeing and regulators and cannot be understated.

1: https://www.seattletimes.com/business/boeing-aerospace/faile...

Re: Boeing 737 MAX crash and the rejection of ridiculous data

#114

Post by VBprogrammer »

fixermark wrote: post #46
quanticle wrote: post #29

On the other hand, one of the contributing factors to the Three Mile Island nuclear disaster was the fact that the temperature sensors were showing their maximum programmed value of 280 degrees Centigrade. The actual core temperature was far far higher, but because the engineers designing the reactor never thought of the meltdown scenario, they programmed the temperature gauge to cut off at 280C, rejecting higher rea…

While this is true, the point that it's worth thinking through the nature and consequences of "obviously erroneous" sensor data is still a valuable exercise holds. If the temperature is past 280, generally speaking the same steps to diminish temperature can be taken (... I'm speaking broadly; this may not actually be true of nuclear reactors and if it's not, additional sensors with larger ranges were definitely warra…

Maybe 25 degrees is a little bit close to a real value. But think of this / flying along this line of text. That is what the AoA sensor was telling the FCC was happening to the aircraft. That's wildly out of range.

Re: Boeing 737 MAX crash and the rejection of ridiculous data

#115

Post by bambax »

chx wrote: post #70

I accidentally copypasted my one time login code into the amount of bill payment and my ebank didn't refuse the sixty seven million dollar payment (I caught it before sending it). Needless to say, I don't have and never had even one percent of that money. My brother one time actually succeeded in wiring ten million euros instead of ten million forints. The exchange ratio is 1:320. Obviously the account didn't have 10…

I sell stuff on Amazon European marketplaces. I sometimes change the price; you have to do that on each marketplace (there are 5: UK FR DE ES IT) in the interface for sellers.

The decimal separator for UK/English is the dot; in all other marketplaces it's the comma. If you put a dot where a comma is expected it's silently ignored (so for example EUR 9.99 becomes EUR 999)... but "slowly": the dot you type appears normally, and then after some periodic ajax validation, it's removed.

I now know this and am careful about it, but the first few times I had my items priced at 100x their normal price, until customers emailed me to ask if this was normal.

It would maybe make sense to issue a warning if the new price differed from the old price by two orders of magnitude. But there's no warning.

Re: Boeing 737 MAX crash and the rejection of ridiculous data

#116

Post by weaksauce »

ChuckMcM wrote: post #90
Ataraxic wrote: post #21

It should be noted in the doomed Air France 447 flight, the plane activated the stall warning because of a high angle of attack that was leading to stall. (thanks pdx for the corrected info) At some point the system rejected the data and stopped the stall warning because the angle of attack was so severe that it considered the data erroneous. This is speculated to have caused the co-pilot to keep pulling back on the…

Your basic point is spot on, it isn't simple. The challenge I think is to keep two things separated, one is the flight control laws that the system is implementing to keep the plane in the air (to the best of its ability), and the other is the situational awareness indicators for the pilots so that they can tell what what the plane is "thinking" about how it is flying (or not). The closest analogy I can come up with…

> It has been reported that this was an "extra price" option for the jet, and it is that choice that makes it feel negligent to me.

not quite. the things they offered for extra were the AoA sensor readouts and an annunciator for AoA disagreement. the mcas was not part of that and the mcas was not briefed in the difference training from the other 737 models. the mcas taking input from a single sensor was to blame. it should not have activated when there was substantial disagreement from the two sensors. it also should have 3 sensors and vote on agreement and not just difference.

Re: Boeing 737 MAX crash and the rejection of ridiculous data

#117

Post by erentz »

Ataraxic wrote: post #21

It should be noted in the doomed Air France 447 flight, the plane activated the stall warning because of a high angle of attack that was leading to stall. (thanks pdx for the corrected info) At some point the system rejected the data and stopped the stall warning because the angle of attack was so severe that it considered the data erroneous. This is speculated to have caused the co-pilot to keep pulling back on the…

His proposal makes no sense. Under his new logic, it would be fine for the MCAS to continue forcing the trim to full deflection and crash the plane if the AoA was stuck anywhere between 15 and 24 degrees.

He's simply not solved the root problem and added a bad kludge for a single error case (AoA stuck > 25 degrees). While at the same time removed a potential safety control for a real world case where the AoA was validly over 25 degrees.

Note: I am assuming by RUNAWAY_TRIM() he means LET_MCAS_ADJUST_TRIM = TRUE; since runaway trim means something entirely different to my mind (that the electric trim is stuck/faulty and causing the trim to run to full deflection in one or other direction).

Re: Boeing 737 MAX crash and the rejection of ridiculous data

#118

Post by linuxftw »

VBprogrammer wrote: post #100
pdx_flyer wrote: post #69

Earlier quoted context omitted.

I know what AoA is and yes, the calculation of AoA by itself is simple, but the corrective measure is not. Classic 737s climb via trim, not constant stick inputs. This has changed slightly with the MAX but now you have automated AoA correction (involving trim). That's a nasty combination.

That's not nearly the case. MCAS is a stupidly simple system intended to cut in during very unusual phases of flight were a normal commercial flight would not be operating.

> MCAS is a stupidly simple system

So, you have reviewed the software? If it's so stupid simple, why did it kill a bunch of people?

Re: Boeing 737 MAX crash and the rejection of ridiculous data

#119

Post by meshko »

All the talk about how crappy Boeing engineering here was is bullshit and speculation and I am surprised PG participates in it. What we can discuss objectively here is incident response in which Boeing allowed the situation to continue after the first crash. How did they not run hundreds of hours of simulations, code reviews etc, etc on the system assumed to be at fault? How did they not immediately change the safety features associated with MCAS to be free and mandatory for everyone? Engineering mistakes happen and are hard to prevent. Business mistakes like this are a sign of terrible culture, lack of priorities and are an existential thread to the company.

Re: Boeing 737 MAX crash and the rejection of ridiculous data

#120

Post by webdevatlurk »

Ataraxic wrote: post #21

It should be noted in the doomed Air France 447 flight, the plane activated the stall warning because of a high angle of attack that was leading to stall. (thanks pdx for the corrected info) At some point the system rejected the data and stopped the stall warning because the angle of attack was so severe that it considered the data erroneous. This is speculated to have caused the co-pilot to keep pulling back on the…

It's interesting to me that the system would be designed to detect that a sensor is feeding it bad data, then go back to trusting that input after it had been determined to be bad.
Post reply on HN