Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Max Crashes Strengthen Resolve of Boeing to Automate Flight

wsj.com

Post reply on HN
Print view View original

41–50 of 50 posts

Re: Max Crashes Strengthen Resolve of Boeing to Automate Flight

#41

Post by ilaksh »

I think more or better automation makes sense. However, in this case, they are just trying a new tactic to deflect blame.

The fundamental problem was that they had new requirements and instead of allowing the engineers to create a new design, management wanted to save money so insisted the engineers shoehorn the new requirements into the old design with hacks resulting in a plane that was fundamentally unstable and ending with hundreds of people dying.

The solution to that problem is to have several executives from Boeing and the FAA in prison. Then break Boeing down and rebuild it as an engineering organization.

After that, yes, continue increasing the automation.

Re: Max Crashes Strengthen Resolve of Boeing to Automate Flight

#42

Post by bkdbkd »

Retric wrote: post #30
turndown wrote: post #3

For the life of me, I have absolutely no idea how you can look at what has happened with the Max and believe that more entrenched automation is the answer.

The argument goes something like this: It’s the disconnect between pilots mental models of what’s going on and what’s actually going on that caused the Max‘s and several other related crashes on different aircraft. As such software designed based on how the system actually works may actually be both simpler and safer than increasingly abstracted fly by wire systems trying to safely intuit what the pilots want. An exa…

While true. That disconnect is not related to the automation system consistently doing the wrong thing. The 'thing the pilots didn't know' enough about was how to turn off the automation. Which was what saved the Lion Air flight the day before was that a jump seat pilot knew how to disable the automation. Increasing the automation in this scenario, does the opposite of what they hope.

Re: Max Crashes Strengthen Resolve of Boeing to Automate Flight

#43

Post by jki275 »

bkdbkd wrote: post #42
Retric wrote: post #30

Earlier quoted context omitted.

The argument goes something like this: It’s the disconnect between pilots mental models of what’s going on and what’s actually going on that caused the Max‘s and several other related crashes on different aircraft. As such software designed based on how the system actually works may actually be both simpler and safer than increasingly abstracted fly by wire systems trying to safely intuit what the pilots want. An exa…

While true. That disconnect is not related to the automation system consistently doing the wrong thing. The 'thing the pilots didn't know' enough about was how to turn off the automation. Which was what saved the Lion Air flight the day before was that a jump seat pilot knew how to disable the automation. Increasing the automation in this scenario, does the opposite of what they hope.

The pilots did know to turn off the automation, and they did exactly that. The problem was that they didn't decrease thrust, and then they turned the automation back on in an attempt to regain control because they couldn't move the control surfaces because they were going too fast.

Re: Max Crashes Strengthen Resolve of Boeing to Automate Flight

#44

Post by bkdbkd »

logfromblammo wrote: post #25

"Our automated system crashed several planes, when the pilots were not able to disable it before it could erroneously trim the vehicle into terrain. "Clearly, we need to remove the human pilots and double down on the automation." [This is where the people using shallow analysis go nuts. But wait.] Because the flawed system was only installed for the purpose of avoiding the expense of retraining human pilots to a new…

And with the design that both Boeing and the FAA certified to fly, that system would simply fly the vehicle into terrain. In this case it is exactly the automation that is at fault, not a pilot misunderstanding or mistraining. The automation system was designed to prevent a pilot from doing something she might have been familiar with doing while flying the old design on the new design. It was designed to keep the pilot from putting the plane in a bad state for flying. That entire system made an error that cost 347 people their lives.

What is painful, is that the pilots recognized that the system was in error, and attempted to correct it, but were unaware that it had the capability to override them. They were unaware because the designers intentionally hid the mechanism. That is made the mechanism hard to see, understand, and needing special knowledge to disable. The designers had not considered all failure modes, but acted as if their implementation was failure-proof and never to be tampered with.

The question in this case is how can one verify something like an automated aircraft system? And more importantly, if there is a technique or practice to assure the system is valid, is the company trying to build it mature enough in its engineering practices to follow it properly?

Re: Max Crashes Strengthen Resolve of Boeing to Automate Flight

#45

Post by logfromblammo »

phkahler wrote: post #37
logfromblammo wrote: post #25

"Our automated system crashed several planes, when the pilots were not able to disable it before it could erroneously trim the vehicle into terrain. "Clearly, we need to remove the human pilots and double down on the automation." [This is where the people using shallow analysis go nuts. But wait.] Because the flawed system was only installed for the purpose of avoiding the expense of retraining human pilots to a new…

>> Because the flawed system was only installed for the purpose of avoiding the expense of retraining human pilots to a new model of aircraft! I'm not sure that's the only reason. Otherwise they should have started building them without MCAS and retraining pilots several months ago. That seems far simpler/cheaper than whatever they're doing now.

They should have put the new engines on a new airframe with more ground clearance under the wings, that would not have required the heavy engines to be pushed forward and change the center of gravity in order to fit.

Such an aircraft would no longer be considered a 737 for the purposes of pilot certification.

The whole thing was motivated by that. Pretend it's the same plane, so that the pilots can pretend to know how to fly it.

It's analogous to hiring a Java or C# applications software developer when your codebase is actually in a proprietary variant of C++. It's close enough that they think they can code in it, but no one ever mentioned how the memory management subsystem is actually just a library written by Dave, who left the company in 2004, and if you aren't careful to clean up your references correctly (according to Dave), the biweekly analysis run will crash-to-desktop in the 14th hour, and you will be called by a panicked twentysomething at 5 AM on a Saturday. Then you find out about the custom compiler (also Dave), and start sending out resumes before it's too late. But with pilots, there's no one else to send the resume to.

Re: Max Crashes Strengthen Resolve of Boeing to Automate Flight

#46

Post by paranoidrobot »

Traster wrote: post #33
wutbrodo wrote: post #17

My knee jerk reaction to this is "more automation after an automation failure? Huh?". But whenever I think someone is being that stupid, it's always worth a second look, and it turns out the reality is more complex. This article[1] linked off of the OP goes into detail about their crashes. It describes a design philosophy that pushes robustness fully onto the pilot, expecting him to flawlessly stitch together indepen…

I think there's a different way to explore this idea. I don't think automation had anything to do with the crashes. The problem was that the pilots weren't trained to know what tools the planes were equiped with and how to use them. Those crashes are like when I accidentally open a file with vim. There's nothing wrong with me, there's nothing wrong with vim but how the hell am I meant to know to hit esc :q? The lesso…

> Those crashes are like when I accidentally open a file with vim. There's nothing wrong with me, there's nothing wrong with vim

I disagree, strongly. The root cause of the issue isn't pilot training.

The root fault is a design issue.

Without the existence of MCAS, these crashes would not have occurred.

Why? Because they would never have been built.

Why? Because the 737 MAX 8 design would not have received approval to be incorporated into the 737 type certificate.

Why? Because the MAX 8, without MCAS, has different handling characteristics during certain phases of flight than the original 737.

Why does it handle differently? Because it has larger and more powerful engines, located differently on the wing, and these changes cause the aircraft to want to pull up more when climbing.

I don't know that the MCAS's programmed behaviors have a good analogy, I can't think of one right now.

Re: Max Crashes Strengthen Resolve of Boeing to Automate Flight

#47

Post by bkdbkd »

jki275 wrote: post #43
bkdbkd wrote: post #42

Earlier quoted context omitted.

While true. That disconnect is not related to the automation system consistently doing the wrong thing. The 'thing the pilots didn't know' enough about was how to turn off the automation. Which was what saved the Lion Air flight the day before was that a jump seat pilot knew how to disable the automation. Increasing the automation in this scenario, does the opposite of what they hope.

The pilots did know to turn off the automation, and they did exactly that. The problem was that they didn't decrease thrust, and then they turned the automation back on in an attempt to regain control because they couldn't move the control surfaces because they were going too fast.

The turn off the MCAS system button on the 737 Max the pilots were using, does _not_ in fact turn off the MCAS system. It is a "Pause the MCAS system button" Even worse, After a few moments, the MCAS system reactivates and then adds even more down trim. So pressing the button, not only does not turn off the system, actually triggers the plane to make the situation worse by adding more down trim.

When the FAA certified the 737 Max the MCAS Software was able to move the horizontal tail a max of 0.6 degrees. (out of a total of 5 degrees) The software flying on those planes was in fact able to move the horizontal tail 4.17 times that amount: 2.5 degrees. They never told anyone this changed. The system went from being able to control 12% of the tail range to 50% of its range.

Those pilots were pulling up on the nose of the aircraft with their feet pressed against the controls. Directing the aircraft with clear intent and skill. The 737's automation had unbeknownst to them and with their knowledge of the aircraft - un-overridable, tilted the horizontal tail into a position that would, under any operating condition direct the nose of the craft into the ground.

Re: Max Crashes Strengthen Resolve of Boeing to Automate Flight

#48

Post by bkdbkd »

paranoidrobot wrote: post #46
Traster wrote: post #33

Earlier quoted context omitted.

I think there's a different way to explore this idea. I don't think automation had anything to do with the crashes. The problem was that the pilots weren't trained to know what tools the planes were equiped with and how to use them. Those crashes are like when I accidentally open a file with vim. There's nothing wrong with me, there's nothing wrong with vim but how the hell am I meant to know to hit esc :q? The lesso…

> Those crashes are like when I accidentally open a file with vim. There's nothing wrong with me, there's nothing wrong with vim I disagree, strongly. The root cause of the issue isn't pilot training. The root fault is a design issue. Without the existence of MCAS, these crashes would not have occurred. Why? Because they would never have been built. Why? Because the 737 MAX 8 design would not have received approval t…

Those crashes are like: You tell your machine to open the file with Emacs, but this new distro has unbeknownst to you (and you find out later, undocumented) symlinked the emacs command to a version of vim with a emacs-like overlay, because of some issue they had. The file crashes vim, but in a crazy memory overflow before he dies manages to take out the system, causing spurious disk writes which corrupts your boot drive.

- The MCAS system. Got bad information and did a very bad thing. It was the entire time operating as it was designed. The fact that the astronauts were not given the information on how to turn HAL off in the event he goes berserk isn't really their fault.

Just to be clear - The MCAS system was actively trying to fly the plane into the ground. It thought it was trying to save the plane from a stall. It was wrong. The pilots attempted to override the system. They could not. They attempted to outfly the system. They could not. They could have killed the system. Boeing did not teach them how.

Re: Max Crashes Strengthen Resolve of Boeing to Automate Flight

#49

Post by jki275 »

bkdbkd wrote: post #47
jki275 wrote: post #43

Earlier quoted context omitted.

The pilots did know to turn off the automation, and they did exactly that. The problem was that they didn't decrease thrust, and then they turned the automation back on in an attempt to regain control because they couldn't move the control surfaces because they were going too fast.

The turn off the MCAS system button on the 737 Max the pilots were using, does _not_ in fact turn off the MCAS system. It is a "Pause the MCAS system button" Even worse, After a few moments, the MCAS system reactivates and then adds even more down trim. So pressing the button, not only does not turn off the system, actually triggers the plane to make the situation worse by adding more down trim. When the FAA certifie…

They pulled the breakers for MCAS. That was the correct action. The problem was that then they turned them back on because they flew the plane into a situation where they could not trim it anymore by hand. When they turned the breakers for MCAS back on, it flew the plane into the ground.

Re: Max Crashes Strengthen Resolve of Boeing to Automate Flight

#50

Post by logfromblammo »

bkdbkd wrote: post #44
logfromblammo wrote: post #25

"Our automated system crashed several planes, when the pilots were not able to disable it before it could erroneously trim the vehicle into terrain. "Clearly, we need to remove the human pilots and double down on the automation." [This is where the people using shallow analysis go nuts. But wait.] Because the flawed system was only installed for the purpose of avoiding the expense of retraining human pilots to a new…

And with the design that both Boeing and the FAA certified to fly, that system would simply fly the vehicle into terrain. In this case it is exactly the automation that is at fault, not a pilot misunderstanding or mistraining. The automation system was designed to prevent a pilot from doing something she might have been familiar with doing while flying the old design on the new design. It was designed to keep the pil…

Every aircraft-building company is mature enough in its engineering practices. Not every company is ethical enough in its management practices.
Post reply on HN