Hacker News Reader

Comment by starpilot | Hacker News Reader

Now, imagine you have 5,000 such checks in millions of lines of flight control system code, many of them interdependent, and you have to fly the ship to test each one. You need to schedule time with the test pilots (who have lives of their own) and get the data dump from IT post-flight. It's aerospace so all this undergoes review, documentation, and signoff, and it all takes time. How do you prevent a single check from slipping through? It's not easy. These software engineers and others in the process screwed up, but it's a failure of processes and not just forgetting a conditional statement.

View on HN

- The MCAS system has more trim authority than the usual (assisted) system

- It was originally intended to have an authority of +/- 0.6 degrees of trim

- Later it was discovered that this it not enough due to the aerodynamic effects of the engines becoming apparent also at lower speeds, which led boeing to increase authority to +/- 2.5 degrees per iteration with unlimited iterations until the maximum range

If you don't believe me, see pprune.org (real pilots discussing the issue) and https://www.satcom.guru/2018/11/stabilizer-trim.html

This is not a software fault.

Unless I'm wrong disabling the MCAS system leaves the elevator at the current trim as set by the jack screw. That's really not the behavior you want. You want the control to return to neutral. Which probably isn't the way the trim mechanism is designed.

This whole thing smells like a bunch of dodgy decisions. Some of them recent and others historical. For instance not being able to manually adjust trim while the elevator is under load. That's dodgy, they got away with it because runaway trim is really rare.

Not a pilot yet myself, but I know exactly enough about flight physics and control to suspect that while you are likely correct about the MCAS jack-screw positioning being undesired, the solution is probably not to auto-return it to neutral.

If we assume MCAS is only disabled in an emergency, we don't want the result of cutting out an automated system to be further automatic manipulation of the control surfaces, right? That's one more weird behavior for the pilots to have to keep in their situational awareness while doing the most important step (i.e. flying the plane).

> we don't want the result of cutting out an automated system to be further automatic manipulation of the control surfaces, right?

You have two separate things a pilot may need to do. One is disabling the MCAS control action. In that case you do want it to return to normal trim. Second is disabling the Automatic/Electrical Trim. In that case you want it to stop and allow the pilot to set the trim manually.

There's no way to "disable MCAS". There's just "disable the stabilizer trim motor". At which point the motor can't help you restore safe trim.

Yes that's more or less it from what I gather. The trim cutout is designed to stop runaway from due to failure of the motor control circuit. Some ommon failure modes leaves the output stuck on. The only fix is to kill the power.

However if you kill the power to the trim motor and then turn it back on MCAS will blindly add more trim on top of the trim it previously added. It doesn't remember how much trim it's already applied.

> How do you prevent a single check from slipping through?

For a start, by not ramming an essentially new type through all test flying & certfication testing in 17 months before declaring it ready for service.

There is a reason that the Soviet Ministry of Aviation made newly-approved types fly only cargo and mail for a year or more; not just because their techniques were 'unsophisticated' per the Western view but also because they understood that introducing a complex system into a complex environment of weather and human factors couldn't be fully modelled but had to be subjected to prolonged real-World experience.

I'm sorry i'll have to mention that the software can be thoroughly tested in simulation flights. Funnily enough i was involved with some virtualisation software used to test booking systems for Airports. If you can virtualise a booking systems, trust me you can virtualise the on-board flights systems.

No doubt you can test on-board flight systems, but you can't really compare virtualizing a booking system with flight systems, which are much more complicated and delicate. Now if you worked at SpaceX and worked on testing their flight systems, then I'd be more inclined to trust you.

> Now if you worked at SpaceX and worked on testing their flight systems, then I'd be more inclined to trust you

Wow that's harsh. You may want to add a bit of sugar to that; it's not nice addressing fellow developers like that. Just a thought.

You can't perfectly simulate the pilot though, that's the big danger with human/automation hybrids.

As with what potentially happened to these crashes, the operating procedures might not be fully known by the pilot. The simulation might also allow the simulated pilot to do things that humans can't, for example turn the trim wheel when the jackscrew is under heavy load from the nose being pitched down.

Is this really true though?

From what I have read it sounds like part of the problem is that manually adjusting the trim wheel requires more strength than at least some pilots possess due to the mechanical forces on the plane. I don't think it's reasonable to expect simulators to replicate those types of forces.

But they do! See the Vimeo link elsewhere in these comments.

It's more an issue of Boeing essentially signing off on their own certification as functionally the same type when it is a very different plane.

The AOA calculation is also much more complicated than the article explains. There is a speed element, engine power, etc.

AoA is just that: angle of attack (https://en.wikipedia.org/wiki/Angle_of_attack)

The sensor simply measures the angle of the airflow with respect to the airframe.

In fact it is just a free-moving surface attached to the airframe.

I know what AoA is and yes, the calculation of AoA by itself is simple, but the corrective measure is not.

Classic 737s climb via trim, not constant stick inputs. This has changed slightly with the MAX but now you have automated AoA correction (involving trim). That's a nasty combination.

That's not nearly the case. MCAS is a stupidly simple system intended to cut in during very unusual phases of flight were a normal commercial flight would not be operating.

> MCAS is a stupidly simple system

So, you have reviewed the software? If it's so stupid simple, why did it kill a bunch of people?

Sigh. I've reviewed almost everything written about the accidents including the information supplied by Boeing to the airlines to explain the function of the MCAS system.

There is no lower limit on the complexity of a system required to kill people.

> including the information supplied by Boeing to the airlines to explain the function of the MCAS system

So, you're essentially parroting Boeing's narrative IMO. Yes, they want you to think that the system is 'stupid simple' and it's 'no big deal, just one little fix' because obviously that's good for their business.

Maybe, the system required for safe operation is not so simple, and Boeing is no longer competent enough to create a system. Perhaps the 'stupid simple' system was all they were able to muster.

Or maybe they forgot to add the flying unicorns to power it.

I'm not sure why you think boeing would lie about it. Or how they'd convince the regulators in two different countries to cover it up since you can see the behaviour by reading the graphs in the preliminary report.

Reply on news.ycombinator.com