Hacker News Reader

Comment by Someone1234 | Hacker News Reader

MCAS problems weren't a memory item for any pilot, the memory item is Runaway Stabilizer and exhibits different behaviour to MCAS.

Which is to say that they'll be receiving sim training for Runaway Stabilizer, learn what to expect (wheel moves continuously, hard nose down, etc), and then in real life have MCAS cause the same issue but in a substantively different way (change, delay, change, delay, etc).

Without the benefit of hindsight why not try the Memory Item: Engine Surge / Stall or Uncommanded Roll? Both of which could exhibit as an uncommanded nose down.

The reality of the situation is that some pilots immediately went straight for Runaway Stabilizer whereas others did not. That's a problem. That's a TRAINING problem. The type rating should have included additional training against the Runaway Stabilizer Memory Item for MCAS so "I've seen this before" is second nature.

View on HN

> That's a problem. That's a TRAINING problem.

Isn't the root problem still related to the fact that the AoA sensors were returning wrong information and the MCAS was simply reacting to that in a dangerous and non-obvious way?

I guess the pilots should be aware of this type of system reaction but still it seems like something that should be fixed at a higher level than training (indicators, backup AoA sensors, detecting dangerous descent after trigging nose down, etc).

There's problems at multiple distinct levels. Regulatory/oversight, unsafe design, lack of information/training, and potentially poor maintenance practices.

If you'll excuse the expression, everyone is going to get poop on them after this one is over.

There's never just one cause of an airline accident. That was one of the causes, but alone it wouldn't have been sufficient. Fixing the problems at all levels is how you achieve high reliability.

Exactly - Defense in depth.

Seems like it would have been sufficient to cause the crash, or are you saying that if the pilots let MCAS do its thing that the plane would not have crashed?

Crash causes:

1. Faulty MCAS

2. Insufficient pilot training

3. Boeing design changes (MCAS used to be disabled automatically if the pilot applied sufficient counter-input, this feature was removed in the -MAX series, requiring the pilot to explicitly disable the system using a separate button)

Take away any 1 of those causes and the plane doesn't crash. They all had to happen at the same time for these two tragedies to occur.

The Swiss cheese model of accident causation.

https://en.wikipedia.org/wiki/Swiss_cheese_model

additionally

4. Insufficient regulatory over site

5. Failed safety analysis

FAA pushed much of the safety analysis to Boeing engineers due to lack of funding and external pressures to help Boeing speed through certification.

The safety analysis was performed on incorrect data. The initial safety report said the MCAS system could lower the nose by 0.6 degrees. After flight testing, that value was increased to 2.5 degrees but the safety analysis was never updated to reflect the new parameters. Additionally, the MCAS system could reset each time the pilot attempted to override, and it could change 2.5 degrees for each reset. So effectively it was unbounded. The numbers on the safety report did not reflect the actual system. If the real numbers had been updated, the problem likely would have been caught sooner.

>MCAS used to be disabled automatically if the pilot applied sufficient counter-input, this feature was removed in the -MAX series

What was the reasoning behind this change?

Presumably so that the pilot can be blamed for not knowing the procedure to manually disable the automatic system that is flying the plane into the ground.

Those fixes are inarguably lower level than training. Not just to be pedantic but the whole reason Boeing is in this mess is because they figured all the lower level things could sort out issues, without engaging higher level fixes.

I'm skeptical of the amount of automation the big manufacturers are pushing. They're creating wildly more complex system interactions in the process.

> skeptical of the amount of automation the big manufacturers are pushing

We need to come to terms with automation as a civilization, lots of things that had a human in the loop will no longer have that person in 0-15 years. We don't realize how important these people are, esp their inaction and delay are very important at damping oscillations. As these automated systems start interacting they will have similar results as the MCAS but without pilot agency.

Look at the panic stops built into financial markets, what systems should have similar that currently do not?

Yes, you're right. Lower level is a more accurate description.

I agree it is a training problem, but it also seems the case that some pilots understand the fundamentals of flight and how a plane operates than others. So when a plane misbehaves, some pilots may have an intuitive sense of what to do, while others are stuck pattern matching and running through checklists.

To make a terrible analogy that trivializes the complexity of flying a jet (because I can't think of a better one), it's like the difference between a chef who knows how to combine ingredients to get the desired result and a cook who only knows how to follow a recipe.

I agree with this and want to expand: Following a recipe == auto pilot; reacting to deviations from the expected / working with new realities == chef (not cook).

The whole point of still having humans in the cockpit, aside from being slightly cheaper than automation right now, is the ability to react to and correct for the unexpected. I agree that this is a terrible engineering design, but that it's only one of the contributing factors. Disasters (nearly always) happen when a string of things go wrong, and safety is about making sure every one of them goes right so that the chances of failure are as close to eliminated as possible.

One of the issues I'm perceiving with the Strings Of Things that Go Wrong / Swiss Cheese model is that as we fix more and more of the ~more likely~ faults to appear, the faults that will continue to appear will be of the less likely variety, so to say more obscure corner cases.

The problem is that training cannot efficiently prepare somebody to identify and fix obscure corner cases while under pressure.

Maybe not plausible, but why not give the pilot a single switch to disable all automation so they can fly the plane without interference.

The reason some of this automation exists is because modern airplanes have, extremely rough corner cases.

In particular, the very thing that is causing the MAX incidents is one of those features that is designed to ADD stability.

The main issue however is that the system is both reading too few external sensors, and is also not reacting to contradictory human inputs.

An ideally designed system might have the following features:

  * Read data from ALL installed sensors that might be applicable.
  * If data from sensors is not within a reasonable bound,
    scream bloody murder about that for a human to make a decision.
  * If human input contradicts the intended direction of the plane,
    scream bloody murder about that for a human to make a decision.

Potential decisions might include designating one or more inputs as faulty, or entirely disabling the function in question. Such an operating mode SHOULD be an exception and should be very obvious for anyone looking at the plane / systems.

Reply on news.ycombinator.com