Slashdot Mirror
Boeing To Make Key Change in 737 MAX Cockpit Software (wsj.com)
Boeing is making an extensive change to the flight-control system in the 737 MAX aircraft implicated in October's Lion Air crash in Indonesia, going beyond what many industry officials familiar with the discussions had anticipated. From a report: The change was in the works before a second plane of the same make crashed in Africa last weekend -- and comes as world-wide unease about the 737 MAX's safety grows. The change would mark a major shift from how Boeing originally designed a stall-prevention feature in the aircraft, which were first delivered to airlines in 2017. U.S. aviation regulators are expected to mandate the change by the end of April.
Boeing publicly released details about the planned 737 MAX software update late Monday [Editor's note: the link may be paywalled; alternative source]. A company spokesman confirmed the update would use multiple sensors, or data feeds, in MAX's stall-prevention system -- instead of the current reliance on a single sensor. The change was prompted by preliminary results from the Indonesian crash investigation indicating that erroneous data from a single sensor, which measures the angle of the plane's nose, caused the stall-prevention system to misfire. Then, a series of events put the aircraft into a dangerous dive.
Boeing publicly released details about the planned 737 MAX software update late Monday [Editor's note: the link may be paywalled; alternative source]. A company spokesman confirmed the update would use multiple sensors, or data feeds, in MAX's stall-prevention system -- instead of the current reliance on a single sensor. The change was prompted by preliminary results from the Indonesian crash investigation indicating that erroneous data from a single sensor, which measures the angle of the plane's nose, caused the stall-prevention system to misfire. Then, a series of events put the aircraft into a dangerous dive.
Why the hell wasn't this the case before?
Aren't flight control systems supposed to be triple-redundant anyway? Everything I've read about them says they are; three systems and if there is incorrect data it uses the two that agree.
msmash: that alternative link has even less useful information than the truncated wsj article.
if ( goingToCrash ) {
dontCrash();
}
It's funny how they point to aviation as nearly infallible when they talk about self-driving cars.
One errant sensor can bring down a plane? Yeah. That makes sense....
You think that's bad, how about the aircraft brought down by a burned out light bulb?
https://en.wikipedia.org/wiki/...
Flying is routine until it isn't. Planes are essentially balancing in the air. It doesn't take much to make one stop flying, and one momentary loss of attention at the wrong time or improper control input can end very badly. All of this x10 if the Pilots haven't been informed of or trained on the failure scenario they're encountering.
-=Lothsahn=-
Well, there's an obvious fix: Turn off the the control system that handles the anti-stall provisions that are likely at fault. Talking to my neighbor (AA pilot who's been trained on 737 Max 8), that was his comment. "It's pretty obvious the pilots need to be trained to turn off the system when they see that behavior."
But to an earlier comment: From the bit I know about commercial avionics safety, if there really is a single sensor that feeds into a control system, that does feel like a violation of safety design standards (for triple redundancy).
I'm betting this is at least in part a 'supplier management' problem on the part of Boeing. That's what led to the Dreamliner battery fires. And the current CEO of Boeing was PM for the big Army FCS program (that I was part of, on the government side.) Boeing did a piss-poor job of supplier/subcontractor management there, and it seems that Dennis Muilenberg took that problem with him when he moved over to the lead for the Dreamliner.
That would have been prevented by the current system.
Unh... Dorsai reference? All my mental banks pull up for "alternate law" is the Chantry Guild. But I'd really like to understand why you think that relates.
I think we've pushed this "anyone can grow up to be president" thing too far.
Given such a serious error, it feels like that Boeing has taken the approach of completely overhauling the flight-control systems, rather than issuing a (relatively) quick change that'd (say) allow the pilot to switch off the system. But this 4.5 month delay has likely caused the deaths of another 157 people.
I'm shocked that anyone at Boeing thought it'd be a good idea to use only use either one sensor or the other (as opposed to a majority rule system with at least three sensors). It makes me wonder how such a critical design decision got past their (internal) peer review process. And now they will undoubtedly be rushing an "extensive change" (before another crash occurs), makes me even more wary of flying in Boeing 737 Max for at least a year or so until it has proven its reliability in the laboratory that is Mother-Nature.
It also seems like Boeing is finally moving to a fly-by-wire system which overrides the pilot like what Airbus has had for decades. But rather than taking a safe, humble approach (such as assuming sensors will go wrong and over-packaging with redundant sensors; as well as putting fly-by-wire into a plane that would operate safety even if the fly-by-wire system is disabled), we have a plane that's apparently more prone to stalling without this immature fly-by-wire system which assumes sensor data is reliable. So we're stuck in an uncomfortable position whereby Boeing can't switch off the fly-by-wire completely (until the more extensive changes are properly tested and incrementally rolled out to airlines on an optional basis over time).
There are undoubtedly Boeing fan-boys/girls who believe Boeing can do no wrong. Awesome, please be beta testers on my behalf.
million dollar aircraft brought down by a cheap sensor failure
Well that's better than the aircraft accident I helped to investigate... The pilot died because of a power switch position he specifically set in order to turn off the system that prevented his aircraft from departing it's "flying" envelope by applying back pressure to his control inputs. When he went to "break" during some ACM training looking over his shoulder at his opponent, he applied too much rudder input, the aircraft snap rolled as it stopped flying and started to tumble, his head was caught between the ejection seat and the canopy and he died of a broken neck before his aircraft hit the water.
That guy died because he wanted the competitive edge and specifically tried to cheat by putting the aircraft in a forbidden configuration....
I'd rather die from a sensor failure than by some stupid mistake I made to get an unfair advantge because I want to win some competition..
"File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
There is an option to disable the system. It's a new system and there was not a lot of training about it though.
Well... What really happened is they ran out of fuel and although it was noticed by some of the crew, nobody thought it was important enough to interrupt the captain in the left seat as he was trying to make sure the wheels where down. Somebody should have been assigned to call out fuel status and not shut up even if the captain was fixated on that stupid light bulb.
It was one of the prompters for the Crew Resource Management movement, which makes subordinates more assertive while still maintaining the authority in the cockpit.
"File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
The have the "bitching betty" who will say "terrain, pull up.... Terrain, Pull up.."
But if the aircraft is fighting you on the "pull up" because the stall avoidance system is run amuck I can see how the mixed signals would be confusing.
Also, it may not be obvious but "Lowest safe value" is constantly changing as you fly around and the way you measure altitude is subject to knowing the local barometric pressure with enough precision, data that the pilots generally provide.
"File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
Since the alternative source link in the summary appears to link to an article about stock prices, here's some alternative alternative links that actually contain more relevant information:
- Boeing press release
- Gizmodo
- Washington Post
Are they going to enable pilots to disable the MCAS from nose diving the plane by pulling up on the yoke too?
Okay lets suppose that some or all of the stall sensors are malfunctioning. There's another sensor that the computer can look at and that's the altitude. If the ALTITUDE is rapidly falling of course the plane might think, see I was right about this stall! But there's one more thing. Namely if the pilots pulled the stick back and the altitude stops falling the plane should now have enough information to figure out that pushing the stick forward is not the right thing to do.
So it seems like the plane should be able to figure out that it's sensors can't be right even if it doesn't know what's exaxtly wrong.
That is, it's job is to overide the pilots if it's convinced they are ignoring a serious problem or doing something to make it worse. But if they do take action and it improves the situation then the logic should be, trust the pilot. Not, continue assuming the pilot is doing the wrong thing.
Some drink at the fountain of knowledge. Others just gargle.
For a system that can kill the aircraft? That sounds like criminal negligence to me. Somebody wanted to do things on the cheap obviously, ignoring all rules of the design of critical systems. In particular, you never, ever rely on a single sensor, and you make damn sure the operators (pilots) understand how things work. About 300 killed people later, Boeing seems to have remembered at least some of the basics.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Admittedly I have not researched it but was stalling a big issue with these planes prior to implementing this anti-stall feature?
Just seems like a solution in search of a problem which often does not end well.
"Action without philosophy is a lethal weapon; philosophy without action is worthless."
It's not a button on the dashboard. It's a complex maneuver:
https://www.nytimes.com/interactive/2018/11/16/world/asia/lion-air-crash-cockpit.html
A description of alternate law as it applies to aviation can be found here although this focuses on Airbus.
Why is there an "insightful" mod and why isn't it "-1"? If I wanted insight, I wouldn't be reading
Boeing is insufficiently managed?
They didn't run out of gas, they disengaged altitude hold mode on the autopilot inadvertently and didn't notice the loss of altitude in time to do anything about it. Widely used to teach pilots that someone has to keep flying the airplane while the rest of the crew debugs the situation.
Since you mention CRM you're probably thinking of a different accident, maybe Avianca Flight 52 (a Boeing 707) that was run out of gas... but that was mostly because the Captain didn't understand English and the co-pilot didn't keep the Captain informed enough about whether ATC understood their low fuel situation. (they had informed the previous controller about their fuel situation but after a frequency change the Captain was confused about whether the current controller knew about their fuel situation).
Back in your day, plane crashes were a regular occurrence, even though there were far fewer aircraft flying.
Because the transient and eternal are the same.
Seven puppies were harmed during the making of this post.
Something struck me regarding latitudes: the Air Lion crash was 6 degrees South (Djakarta), the Ethiopian crash was 9 degrees North (Addis Ababa) ; both flights were close to the Equator (symmetrically). Could have something to do with sensors reliability.
Slashdot, fix the reply notifications... You won't get away with it...
Well... What really happened is they ran out of fuel and although it was noticed by some of the crew, nobody thought it was important enough to interrupt the captain in the left seat as he was trying to make sure the wheels where down.
You're thinking about United 173 that crashed outside Portland, OR. Different accident from the "lightbulb" Eastern Airlines flight.
Yep -- and the fatality rate per passenger mile was much higher "back in the day".
Why is there an "insightful" mod and why isn't it "-1"? If I wanted insight, I wouldn't be reading
There are two AOA sensors. What the software does with their inputs is of course another matter. It seems like it would be nice to have three, but there other things that there are only two of (like engines on most commercial airliners) and pilot input is needed to respond to a failure of one. Of course, the pilot needs to understand that there's been a failure.
Why is there an "insightful" mod and why isn't it "-1"? If I wanted insight, I wouldn't be reading
Thank you. Someone please mod parent up as informative.
I think we've pushed this "anyone can grow up to be president" thing too far.
Your point about "know there's a failure" is relevant. But if the two sensors don't agree, then the '3rd factor' is the pilot. System reports "sensor failure" and the pilot turns off that anti-stall system. The rules as I understood them (I am not a safety engineer, but I've had some training in this area) is to use voting to detect the failure. For an engine, there are other ways to detect the failure than seeing if the engines are all turning at the same RPMs :-)
Uh...no. Have you seen the simulators? Are you aware of the cost? These are not rookie pilots but pros with typically 2 decades of experience under their belt. The simulators are essentially the real deal. This isn't Chuck Norris air combat.
After consideration they decided that the big red elbow-activated "Crash NOW!" button was to easily accidentally struck when pilot stretches, or scratching self.
Re-thinking similar function button small button next to light button above each passenger seat, and in bathrooms.
https://youtu.be/LwjP8HCpE4E.
... after the Lion Air crash, knew of the needed fix
Boeing doing something while nobody is requesting a change is highly suspicious, and could be seen as an acknowledgement of responsibility.
Slashdot, fix the reply notifications... You won't get away with it...
It's especially highly suspicious when they start doing it before we even have a public available investigation report.
It's a button in the aft toilet under a locked flap with "beware of the leopard" written on it.
Confucius say, "Find worm in apple - bad. Find half a worm - worse."
If you've heard Sen. Blumenthal talking about how the Max 8 is "unsafe at any speed", needs to be grounded, and that Boeing and the FAA need to be raked over the coals, note that he's in the pocket of Boeing's only real competitor, Airbus.
This is why you NEVER override the pilot. Warn them, fight them, irritate them, but *never* override.
~Any apparent grammatical or typographic errors are caused by defects in your display device.
https://www.dallasnews.com/bus...
“The disclosures found by The News reference problems during Boeing 737 Max 8 flights with an autopilot system, and they all occurred while trying to gain altitude during takeoff — many mentioned the plane turning nose down suddenly. While records show these flights occurred during October and November, the information about which airlines the pilots were flying for is redacted from the database. Records show that a captain who flies the Max 8 complained in November that it was ‘unconscionable’ that the company and federal authorities allowed pilots to fly the planes without adequate training or fully disclosing information about how its systems were different from previous 737 models.”
My ground school instructor used that exact example and called it the "three idiot rule" that you couldn't have everybody trying to troubleshoot a problem at once.
He likened it to 3 points of contact in free climbing. Of your four limbs, you can lift one from the surface at once.