Max Crashes Strengthen Resolve of Boeing to Automate Flight

This article[1] linked off of the OP goes into detail about their crashes. It describes a design philosophy that pushes robustness fully onto the pilot, expecting him to flawlessly stitch together independent automated systems and unreasonably rapidly interpret and react to their error modes. In the case described in the article, separate automated systems had contrasting views of the world, and shouted their contradictory errors at the pilots, relying on them to be able to instantly reconcile these models and figure out what the root problem was. (In this case, a specific sensor failure made a single system think the plane was pointed up, and this system made the isolated decision to push the nose downwards while warning that the nose was too high. Naturally, other systems simultaneously complained about the nosedive).

One solution, of course, is to remove automated systems from planes. But assuming they provide any value (I don't think this is in dispute?): another, more reasonable strategy is to commit more fully to an automated system design that is intentionally fault-tolerant, robust to system and sensor errors, and has a more complete view of the plane's world. Instead of requiring the overall state of the meta-system to be lossily communicated to humans in a time-critical emergency, the newer designs are intended to use all the information available to the plane's systems to reconcile subcompoments' contradictory view of the world. Note that this doesn't preclude human control at all: if anything, it makes pilot control _safer_, since the system can provide a coherent view to the pilot in a way that's currently impossible.

I don't know enough about large aircraft operation to fully comment on the wisdom of this approach, but it's substantially more complex than "auto system failed, why would they expand use".

[1] https://www.wsj.com/articles/the-four-second-catastrophe-how...

Algorithmic correctness won't necessarily help you if the root problem is bad sensor data.

As far as I have been able to gather, the MCAS software performed exactly to spec. You may have been drawn to the Boeing straw man narrative "the software was faulty (we can fix it)".

My knee jerk reaction to this is "more automation after an automation failure? Huh?". But whenever I think someone is being that stupid, it's always worth a second look, and it turns out the reality is more complex.

This article[1] linked off of the OP goes into detail about their crashes. It describes a design philosophy that pushes robustness fully onto the pilot, expecting him to flawlessly stitch together independent automated systems and unreasonably rapidly interpret and react to their error modes. In the case described in the article, separate automated systems had contrasting views of the world, and shouted their contradictory errors at the pilots, relying on them to be able to instantly reconcile these models and figure out what the root problem was. (In this case, a specific sensor failure made a single system think the plane was pointed up, and this system made the isolated decision to push the nose downwards while warning that the nose was too high. Naturally, other systems simultaneously complained about the nosedive).

One solution, of course, is to remove automated systems from planes. But assuming they provide any value (I don't think this is in dispute?): another, more reasonable strategy is to commit more fully to an automated system design that is intentionally fault-tolerant, robust to system and sensor errors, and has a more complete view of the plane's world. Instead of requiring the overall state of the meta-system to be lossily communicated to humans in a time-critical emergency, the newer designs are intended to use all the information available to the plane's systems to reconcile subcompoments' contradictory view of the world. Note that this doesn't preclude human control at all: if anything, it makes pilot control _safer_, since the system can provide a coherent view to the pilot in a way that's currently impossible.

I don't know enough about large aircraft operation to fully comment on the wisdom of this approach, but it's substantially more complex than "auto system failed, why would they expand use".

[1] https://www.wsj.com/articles/the-four-second-catastrophe-how...

Crap I meant to make the above comment as a top level comment, not a response.. Somehow it came through twice.

Anyway, in response to your comment: perhaps I'm conflating these, but a commitment to robustness seems like it's included in the newer philosophy? It just extends that notion beyond the sensor-level to the system level.

Sure, you can frame an inadequate emphasis on robustness as a "management problem" instead of a technical one, but that seems equally applicable to the "management solution" being put forth, no?