Hacker News Reader

Comment by ptidhomme | Hacker News Reader

What I fail to understand is why do they not design an overriding scheme to MCAS, such as an "above-threshold" pull on the stick by the pilot. I can recall that this was a classic design by Boeing. Whatever the number of AoA sensors, the system should be easy and straightforward to disable.

Those logics of "let's guess automatically if that sensor is failing" are just pushing the problem further. The real problem is too much reliance on automatic systems and top little human integration in the overall system (the human-machine system, that is to say).

View on HN

New overriding scheme means more training. The selling point of 737MAX is any 737 pilot can fly on it without new training.

That was the selling point, yes, but it doesn’t seem to be quite true in real life.

So if they can’t hold that promise anyway, why not provide a better interface?

Because if they didn't pretend that it was the same to fly a 737 and a 737 max, then they would be required to have pilots get a separate type certification for the max, which is costly for airlines and makes the airlines very reluctant to order the max.

Well, it was the selling point. I'm thinking now of the upgrades.

Anyway, for the sake of selling, they went into the biggest failure of modern aerospace engineering. This should just not have happened.

I can't stop thinking whether similar "compromises" had been made when redesigning the airframe. It's engineering after all. The engineers could be pressed by the management to make certain changes for the sake of profit.

But managers rely on engineers to let them know when some compromise can be made and when it is absolutely vital not to do it.

But management also relies on customers to tell them which compromise is vital to selling a product. And in a market with such huge price-pressure as aeronautics, I can easily see how this is going to override engineer's concerns.

I don't think that any Boeing customer have said or implied that it's OK if a plane can crash as long as they save up on pilot training.

Didn't they "vote with their wallets"?

They certainly voted with their wallets for a plane that doesn't require additional training. But they sure as hell did not vote with their wallets for a plane that does that on expense of crashing. And, to reiterate my point, I think that managers who pushed for trade-offs between different objectives did not push for this particular trade-off either.

Well, that's the law of unintended consequences. Customers wanted so not pay for retraining, Boeing wanted to get to the market faster and not wait for re-certification, managers wanted a physical problem fixed in software - and in the end the envelope got pushed too far.

I am sure the company operating the Titanic didn't exactly strive to have a shipwreck either.

This is true, but it is a statement about causality and the thread was about responsibility. Those are two different things. The fact that your actions lead to a certain outcome does not automatically mean that you're morally responsible for this outcome (that's the fallacy that leads to victim blaming, among other things).

It is always engineer's responsibility to clearly explain the trade-offs to the managers. Only a manager who's making the decision with accurate information can be responsible for it.

Of course they didn't; the damage to the airline's reputation would be terrible. The customers didn't make this choice; they were deceived by Boeing, who sold them on the idea that they didn't need any significant new training for this disaster of an aircraft. The customers didn't design this thing, they just bought it after listening to Boeing's promises.

The problem isn't too much reliance on automatic systems, it's that the systems are a half baked combination of the two.

The MCAS system is an example of that. As you say that overriding design is typical in Boeing planes, but MCAS purposefully overrides it, that is, pushing the controls hard, which overrides other automatic functions, has no effect on MCAS.

I'd say this is why they are half-baked : human integration was not thouroughly thought of in the design. When I speak of overriding, I mean human overriding.

This is something I think Boeing had got right with its manual overrides : when you design critical systems, you need human backup schemes, but you can go further and make these backup tightly integrated with the rest of the (highly automated) system.

I'd say this is why they are half-baked : human integration was not thouroughly thought of in the design. When I speak of overriding, I mean human overriding.

That's pretty obvious, given by the fact that the system was initially not even documented nor was the scenario allegedly available for training in the brand spanking new 787-MAX simulator.

The airline manufacturers have to push for automatic systems as they are the one of the features that sells.

One of a close friend of mine who works at Airbus said that the company believes the next gen aircrafts would only require a single person in the cockpit, and everything will be handled through automations.

Airbus aircrafts are more automated than Boeing. If Boeing does not work on the automation part, it could loose to Airbus. Airbus faced AoA problem back in 2009, when Quantas flight suddenly dropped from the air. But they were able to patch it up within a month and no reported case has come up since then.

So I believe Boeing working on Automation is a good thing, and they should be able to fix it up.

> the next gen aircrafts would only require a single person in the cockpit, and everything will be handled through automations.

Hasn't that myth been around for years, along with "Planes can take off and land by themselves?"

https://www.askthepilot.com/questionanswers/automation-myths...

He may be right for the state of what has actually been wired up in today’s cockpits, but conceptually I don’t see why you couldn’t fully automate a plane. Even in emergency situations, pilots are required to follow established procedures and check lists, not become creative. The pilot mentions the example of an aborted take off, I can’t think of any reason an auto pilot wouldn’t be able to perform one. And of course you will need even more redundancy than there is today as you won’t have pilots who can look out at the window and come up with their own opinion of what is going on, and challenge improbable readings. Plus you can always have the option to have remote manual control if you really need to.

Of course there are parts of today’s aviation that are incompatible with automation. ATC over radio is one of them. Visual landing only at many airports is another one. There would be large costs to upgrading the infrastructures to be computer friendly, so I am not saying the switch is trivial, but it is bound to happen nevertheless.

He may be right for the state of what has actually been wired up in today’s cockpits, but conceptually I don’t see why you couldn’t fully automate a plane.

Good luck finding paying customers to board such a plane.

They will probably have lower operating costs. That will be a reason. And when they demonstrated their reliability over time people will stop thinking about it. Pilot error is still the number 1 cause of plane crashes.

I dunno, I'd trust automation from Airbus more than a low-payed over-worked low trained pilot from a low cost no-non European carrier.

After Boing's major fuck up I'm not sure that this comment will age well.

IMO pilots are there in case shit really hits the fan, or birds hit the turbofans: I doubt computers would be creative enough like Sullenberger and decide to land on a river.

And 2 pilots means 2 brains that can divide the workload...

Fair point, but even then you could have a remote pilot telling the plane what to do with the automation executing the strategy (given the latency).

If the remote ground-based pilot has the capability to take total control authority of the aircraft (which, after the GermanWings incident would seem to be a necessity), then the security implications are massive. Imagine a remote-control attack on an aircraft carrying 800+ passengers...

https://en.wikipedia.org/wiki/Iran%E2%80%93U.S._RQ-170_incid...

> I don’t see why you couldn’t fully automate a plane.

every nut and bolt can and will break. every component load increase battery size and generator load, carrying a greater risk for fires.

if you go down the path "automate with manual backup" then you introduce even more fault-prone systems: the circuitry that disable automation might be faulty and can be another fire risk all of itself and the conflict between faulty automation and manual overrides could be itself an aggravating issue in an emergency.

and even if your plane is perfect, you have to live in an imperfect environment (same argument as car autopilots really): other plane around you might have an emergency, forcing your to delay landing. the airport might have an emergency, forcing a detour, the ils could break down, even on final.

it's exceedingly hard to write software that handles the common cases well enough, imagine having to write software to handle also the unforeseeable faults.

> remote control

and this introduces a whole new topic: systems rarely used are the ones with the more reliability issues. both manual and remote override, on top of being more stuff with their own failure modes, would be rarely tested in practice until the moment they'd be needed the most.

Combinatorial complextity. It's impossible to foresee every possible combination of failures. There are checklists for the ones that can be foreseen (and these have often been written in the blood of those who discovered them) and maybe in theory most of those could be automated. But they cannot be exhaustive. So when all else fails, you rely on human intelligence guided by experience and training as the last line of defense. It doesn't always work, but until we have an AI that performs better, it's the best option we have.

Automation is not bad per se. What I mean is that there must be an opportunity for human override at all levels of automation (and as seamless as possible) in case of machine failure. It does not deny that it could be done by one pilot only, or half a pilot or even somehow a remote human intervention.

When designing a critical system such as an aircraft, you must include human authority into it. No technology will ever be 100% foolproof. This is not a stance against technology, automation or innovation, it's a matter of concept : most of systems (and aircraft in particular) are human-machine systems.

You cannot design an unoverrideable automatic mechanism. Think of how you can appreciate the capacity of full control over your computer and your OS (happy OpenBSD user here, for the record).

>When designing a critical system such as an aircraft, you must include human authority into it

This is where Boeing messed up big time. According to the article they only had 2 AoA sensor, completely missing the fact that what happens if one sensor fails and which is correct. Airbus has 3, but IMO a critical component like an AoA sensor there should be 5 + additional inputs from the artificial horizon should be considered.

>You cannot design an unoverrideable automatic mechanism.

Yes, it makes sense. Even a complete automatic mechanism would need functionality to override in case things go completely haywire.

>This is where Boeing messed up big time. According to the article they only had 2 AoA sensor, completely missing the fact that what happens if one sensor fails and which is correct.

No, you missed something really critical in all this. There are 2 AoA sensors, however only 1 of them is used as input for the MCAS system. There was no redundancy whatsoever!

The proposed software patch will use both AoA sensors, and light an indicator light if they disagree. They don't want to retrofit the planes with 3 sensors like Airbus, because obviously Boeing cares more about profits than safety and good engineering.

Reply on news.ycombinator.com