Hacker News Reader

Comment by WalterBright | Hacker News Reader

All you gotta do is watch a few episodes of "Aviation Disasters" to conclude that the pilot needs a backup - the copilot.

After all, when the pilot goes to the potty, who is flying the airplane? The computer? LOL. When something unanticipated goes wrong, the computers are COMPLETELY USELESS because it wasn't programmed to deal with unanticipated problems.

Me, I'll pay a bit extra for my flight to have 2 pilots.

Pilots:

1. fall asleep

2. get distracted

3. make mistakes

4. misinterpret what is going on

5. panic

6. have heart attacks

7. take breaks

8. use the wrong checklist

9. have bad days

10. forget to watch the airspeed and altitude

11. skip steps on the checklist

I.e. are human.

And so a backup is needed.

View on HN

But would that pilot have to be in the plane to fly it? We have been using remote controlled killer drones for years now.

> More than 400 large U.S. military drones have crashed in major accidents around the world since 2001

Quote from 2014: https://www.washingtonpost.com/sf/investigative/2014/06/20/w...

I think with planes carrying humans we don't want that track record, especially if you calculate crashes per mile flown.

I am not a pilot. But given my experience driving cars in video games, and driving them in 3D land, there's no comparison.

A remote operator cannot pick up a fire extinguisher, go into the cabin and look out the window, smell the smoke, feel the weird vibration, relieve the pilot who is pulling on the controls with all his might, fend off intruders with the fire axe, etc.

Remote control is always going to have a lag in it. I doubt one could land an airplane remotely even with just a 1 second lag.

Having your butt in the seat of the airplane is a strong motivator to keep it flying. The pilot always arrives first at the scene of the crash.

Now imagine what happens if the connection gets hacked

We’re getting really close to the old joke - planes will have a computer, a pilot, and a dog. The computer is there to fly the plane, the pilot is there to feed the dog, and the dog is there to bite the pilot if he tries to touch anything.

"Attention passengers, I've got good news and bad news. The bad news is that Captain Ovarwurked has, sadly, passed away while flying the plane. The good news is that a remote backup pilot is now going to fly us to the nearest landing field! Please sit back and relax, and try not to think about the person sitting in the comfort of their home with an Xbox 360 controller who hopefully has a stable internet connection. [1]

On that note, we'd like to ask everyone to please stop using anything wireless, as it runs a small risk of interfering with the delicate connection to satellites overhead, which is currently all that is keeping our remote pilot connected."

[1] https://www.pyrosoft.co.uk/blog/2007/11/04/army-fly-uav-spy-...

Just look at the MCAS disaster. The only override that wasn't under its control required someone present in the cockpit to basically physically lift the plane using a normally automated control.

This illustrates two things: First the design of the software used in commercial airplanes is bat shit insane and second, the fallbacks require that a trained person is physically present on the plane.

> We have been using remote controlled killer drones for years now.

While Boeing has shown some talent at killing people the goal of commercial airplanes is usually to get their passengers to their destination alive.

I know a bit about the MCAS disaster. Very few people know that there were *three* incidences of MCAS runaway trim. What happened with the third one (which was actually the first incident)? It didn't crash. The pilot just turned off the stab trim system.

The override was there, it was always there. The thumb switches on the control column overrode it. Turning it off with the STAB TRIM CUTOFF switch turned it off.

This procedure was detailed in an Emergency Airworthiness Directive issued to all 737MAX pilots after the first crash. The pilots in the second crash did not follow that procedure.

The pilots of all three incidents used the thumb switches to override MCAS and restore normal trim. The first crew then turned off the trim and landed safely. The second crew never did turn off the trim and crashed. The third turned off the trim when the airplane was in a dive and could not recover.

It is also interesting that in that third incident it was the presence of a THIRD pilot in the cockpit that helped to diagnose the problem.

Huh, if only there could have been some kind of training that would be required to use this new system, but that would require recertification!

Or if this system wasn't so badly designed to require yet another training class.

Pilots are already trained to turn off the STAB TRIM when it misbehaves. The switch to do it is prominent on the console for good reason.

> Turning it off with the STAB TRIM CUTOFF switch turned it off.

> The pilots in the second crash did not follow that procedure.

"At 05:40:35, the First-Officer called out 'stab trim cut-out' two times. Captain agreed and First-Officer confirmed stab trim cut-out."[1]

However they were unable to correct the trim of the aircraft without help of the electrical systems (still being on full takeoff power didn't help).

So around 3 minutes later stab trim cutout was switched back to normal. Pretty much the moment they did that the aircraft pitched down hard, the situation becoming unrecoverable within seconds, followed by the aircraft impacting the ground.

There were possibly ways to save the aircraft (reduce aerodynamic forces that prevented trim by hand by, for instance, reducing thrust), but those weren't detailed in any ADs.

[1]https://leehamnews.com/wp-content/uploads/2019/04/Preliminar...

The instructions in the Emergency Airworthiness Directive said:

1. restore trim to normal with the electric thumb switches on the column

2. then turn off the stab trim

The electric trim overrides MCAS.

Boeing Emergency Airworthiness Directive:

"Initially, higher control forces may be needed to overcome any stabilizer nose down trim already applied. Electric stabilizer trim can be used to neutralize control column pitch forces before moving the STAB TRIM CUTOUT switches to CUTOUT. Manual stabilizer trim can be used before and after the STAB TRIM CUTOUT switches are moved to CUTOUT."

https://theaircurrent.com/wp-content/uploads/2018/11/B737-MA...

> 1. restore trim to normal with the electric thumb switches on the column

That's probably not an easy thing with a computer undoing your work every few seconds and fighting you for control.

And they did try to correct the trim before moving to 2.

5:40:00 AND (here automatic nose down) activates for 9 seconds, computer trimming from 4.60 to 2.1 units, crew trying to counteract by pitching up.

5:40:14 Pilot begins adjusting trim up. Gets to 2.4 units.

5:40:22 AND activates yet again (7s), also pushing trim all the way down to 0.4 units. DON'T SINK warning and PULL UP.

5:40:29 Captain asks the First-Officer to trim up with him. They reach 2.3 units (9s). This interrupts AND.

5:40:38 stab trim cut-out

5:40:43 AND activates again, but at least now it leaves the stabilizer alone.

All in they did fine, considering all this happened in 40 seconds. They regained control of the aircraft and now have time to asses what even happened.

However they still have to apply up to 100lbs of force to keep the nose somewhat pointed up. Only at times when both of them are actually pulling on the stick does the plane gain altitude. On top of that they're getting a MASTER CAUTION "anti-ice left alpha vane", adding to their workload. In the next three minutes they're discussing the warnings they're getting, informing ATC of their problem, and are trying to manually trim the plane (which doesn't work). I'd imagine their arms are getting tired.

So the understandable next step is to switch stab trim cut out back to normal, then trying to correct the trim further.

5:43:11 stab trim back to normal, followed by some short manual electric trim inputs

5:43:21 AND triggers yet again (5s), stab to 1.0 units. Within the first 3.5s the aircraft pitches -8° down, descent rate increases to -5,000 ft/min.

If they had caught and interrupted the AND/flipped stab trim back immediately, maybe this could've been saved. But since the computer got to do its thing for a few seconds, it's pretty much too late to do anything. The pilots are applying up to 180lbs of force, which accomplishes nothing. The plane keeps pitching further down.

5:43:44 Plane impacts the ground at an angle of 40° nose down.

That whole timeline was 3 minutes, 44 seconds.

The only way you can reasonably expect a human to deal with a situation like that, which requires a quick response, is if you train them for it. You don't just give a vague warning, a bunch of steps with three IFs attached, and hope for the best.

More complete, interim, report: https://reports.aviation-safety.net/2019/20190310-0_B38M_ET-...

I did read the EAD. I even quoted it.

> That's probably not an easy thing with a computer undoing your work every few seconds and fighting you for control.

Having the trim start running again every few seconds is EXACTLY WHY there's a trim cutout switch. A few seconds is enough time to hit the thumb trim switches right on the column under your thumb, and the then hit the cutoff switch which is right there on the center console.

I don't dispute the timeline. But the fact remains, using the electric trim switches to return trim to normal, then turning it off, would have worked.

The stab trim does not move that fast, they had time to turn it off after trimming to normal.

Thanks for the link. At one point, it was clear the EA pilots did use the electric trim switches to override MCAS. They did turn off the trim at one point. What they did not do was follow the instructions in the EAD.

> maybe this could've been saved

The first incident shows the procedure works. Trim to normal, turn it off. That's all there is to it.

The thing about the Emergency Airworthiness Directive is it came out after the first MAX crash, and was about how to not die if it happens to you. If you were a MAX pilot, wouldn't you take extra care to read that EAD, understand it, and remember it? I cannot fathom ignoring it.

> I cannot fathom ignoring it.

I can see why it they wouldn't have recalled it in the first 40s of that situation. However they got the situation stabilized to a point where they could've kept going for a while and maybe came up with a better plan of action before attempting to correct the trim again (which is what ultimately doomed the flight).

> Having the trim start running again every few seconds is EXACTLY WHY there's a trim cutout switch. A few seconds is enough time to hit the thumb trim switches right on the column under your thumb, and the then hit the cutoff switch which is right there on the center console.

Which is kind of leaving the territory of the AD. The way I'm reading it, it advises to leave the switch set to cutout for the remainder of the flight. They'd have had to come up with that approach (or an approach that would have enabled manual trim) on their own once they had the aircraft flying somewhat straight without immediate danger. Their main mistake may have been to not take more time to assess their situation when they had the chance and not fully grasping the danger of leaving that switch on normal for even the 5s it took the plane to become unrecoverable at the end.

But all those factors pale in the face of inadequate training and the fact that there could hardly be a more dangerous problem with an aircraft than it - out of nowhere - entering an uncontrollable nosedive if the pilots don't properly respond within seconds. I'd maybe rate complete loss of control/"wings fell off" higher.

I still have trouble blaming the pilots because - with the benefit of hindsight - I would have expected such crashes to happen as much as they did, maybe more. The aviation industry generally avoids expected mistakes that result in loss of life and someone was bound to make this one.

> Which is kind of leaving the territory of the AD.

No, it isn't.

> The way I'm reading it

What it says is to restore trim to normal and then turn it off.

> not fully grasping the danger of leaving that switch on normal

Uncommanded stabilizer trim movement is a severe problem which is why what to do about it is a "memory item", meaning you don't have time to read the checklist. All pilots should know that runaway trim is a critical danger.

> out of nowhere - entering an uncontrollable nosedive if the pilots don't properly respond within seconds

There's enough time to respond. All three crews correctly restored normal trim immediately.

> I still have trouble blaming the pilots because

I give the pilots some of the responsibility, because they had all the information needed to counter the problem. The rest goes to Boeing for a bad MCAS design. It's a pilot's job to read, understand, and remember Emergency Airworthiness Directives. If that's unreasonable for them, they need to turn in their wings and drive an Uber.

I find no fault for the pilots of the Alaska crash where the stabilizer trim jammed. There were no instructions on how to deal with that, and they were in contact with the maintenance chief who had no clue, either. The pilots kept trying to break the jam loose, doing things like engaging both trim motors to apply more torque. The result was the jackscrew nut stripped the threads, and then it slid to hard over, then broke the end of the jackscrew off, and it was game over.

Now me, as an engineer who knows how that system works, I would have advised them to leave it alone, reduce airspeed to reduce the loads on it, and land ASAP. The jackscrew motors are way too powerful to let them grind away at it. Also, when it did move, it let off a very loud screech indicating that something awful was happening.

But they weren't engineers or mechanics. They made a mistake, but it was reasonable considering what they knew. They did the best they could.

Give me whoever you consider the best two pilots on earth and I promise you they'll have a collective minute of suboptimal decision making at some point, especially when confronted with an extremely sudden stressful situation. Humans don't work the way you're implying they do.

However we design systems and procedures such that suboptimal usually doesn't mean fatal, and in those specific instances where it would, we train humans so they perform adequately.

If humans were so great, we wouldn't need a lot of the technology in modern aircraft. It's mostly there because humans suck. Taking work away from the meatbags, putting in safeguards, and designing with the human element in mind, produces more desirable outcomes.

And it's not like this crew had the wrong ideas. They attempted all the right things, but execution was lacking and sadly the situation had no room for error:

1. Did use cut out, but left it on normal for a few crucial seconds without any manual input, allowing the computer to mess everything up again.

2. Did try to fix trim before cut out, but only got it halfway there to the point where they could at least achieve level flight and a slight climb. Tried to trim the rest of the way manually, but that didn't work.

> There's enough time to respond.

Disregarding that the situation could have been avoided, the second time this crew didn't have time to react anymore. It took only 3.5s from the automatic nose down engaging to descending at -5,000 ft/min, pitching -8° down and quickly increasing to -40°, despite the pilots pulling on their sticks full force. They had maybe a second or two to nip it in the bud, then had twenty seconds left to somehow arrest the rapid descent of an aircraft that is trimmed precisely the wrong way with the horizon in a place you don't ever want to see it in a commercial airliner. I don't think it was physically possible?

It's not hard imagining situations where an aircraft doing something like that within 3.5s out of nowhere would be disastrous. There certainly wouldn't be time to respond. This crew was warned by earlier misbehavior, so the situation was theoretically avoidable, but there was little room for error and so we should be glad for all the times something didn't happen.

> All three crews correctly restored normal trim immediately.

Are you counting this crew? I don't think they had normal trim at any point once the incident started. They were trying to get there.

Yes, people make mistakes. And we should design systems to be tolerant of those mistakes. With airplanes, we try to think through all the emergencies first, figure out how to fix them at leisure, then write it down in the form of a checklist or an Emergency Airworthiness Directive.

We expect pilots to pay attention to those things. They make mistakes, sure, but they are still responsible for those mistakes. The EA pilots did not follow the procedure laid out as "how to not die like the Lion Air pilots". Seems to me that should be worth reading, understanding, and remembered. Especially as there was nothing complicated about it - trim to normal, turn it off.

Wouldn't you prefer to fly with pilots who did? I do.

>First the design of the software used in commercial airplanes is bat shit insane

At least in that case. But it isn't normal that you blindly trust a sensor, not even Level D (failure is unimportant and easy to deal with) Software would/should do that. It actually takes a significant effort to put Software into a plane, which only increases with safety requirements.

The chain of failure which needed to happen in this case is enormous. Dozens of people need to have looked at the documentation and nobody cared/figured out this blatant security issue. How can a company like Boeing even operate like that?

> which only increases with safety requirements

Yes, safety requirements which include the double buffer of two trained and experienced human pilots being in physical command of the plane double checking themselves and the software/hardware

>Yes, safety requirements which include the double buffer of two trained and experienced human pilots being in physical command of the plane double checking themselves and the software/hardware

A lot of hardware/software is totally automatic and it would be insane if it were constantly checked by humans. Of course none of these systems running totally automatic have the ability to push thevplane into the ground based on faulty sensor data.

My point was that the failure of the MCAS was institutional, you should not be able to bring software like that onto a plane.

On the topic of the number of pilots my thoughts are that the redundancy is for the most part only neccessarry in exceptional situations. But exactly those situations are the ones in which the best thing a plane can usually do is graceful failure and handing control to the crew, which can far more easily overwhelm a single pilot.

> Of course none of these systems running totally automatic have the ability to push the plane into the ground based on faulty sensor data.

The yaw damper does.

There was another crash where the autothrottle was reading data from only one of the radio altimeters, which was giving false data. At 400ft altitude the autothrottle thought the airplane was landing, and pulled the throttles back to idle. The airplane pancaked into the ground.

All avionics software that has control authority can crash the airplane.

What was wrong with MCAS was its reliance on only one sensor, and no way to tell if the sensor was faulty. That's not an issue with the concept of MCAS.

https://forums.flightsimulator.com/uploads/default/original/...

Yes, we can do it, but have a look at the data: https://www.dronetechuav.com/post/causes-of-uav-loss

I don't think that argument flies.

Political cost of losing an UAV is extremely low.

If the pilot goes all Germanwings and decides to fly the plane into a mountain, what is the pilot on the ground going to do about it?

If your answer is “the pilot on the ground takes control”, what happens when that system gets hacked?

You could theorize a simple remote override that is simply “deviate to nearest appropriate airport and land” but that requires substantial support AND doesn’t handle all sorts of abnormal situations beyond “pilot died”.

If the civil aviation sector suffered hull losses at the same rate as remote control war drone flying does[0] - even excluding those shot down - the entire industry would be bankrupted within a few years.

Also, this is an attempt to reduce labor costs. They aren't going to put a pilot on the ground as primary or backup - they just want to remove the second pilot from the loop entirely.

We have a list of airliner crashes[1], that once we figure out absolute numbers of total flights likely shows that airliners are much, much safer than remote controlled drones (after excluding shoot downs for latter), but what we don't have is data on how many aircraft landed safely but only because the second pilot was there. I'd want to know:

1. How many times did a pilot immediately intervene for a developing safety issue while the other pilot was asleep, in the toilet, or suffering from a medical incapacitation? A huge amount of work has been done to ensure redundancy of human control in such situations, because many crashes have occurred where this process failed.

2. How many times did a pilot make a mistake that was corrected by a second pilot, and if that correction hadn't been made a safety issue would have developed? There are numerous crashes attributed to pilot error and the second pilot failing to correct that error - a huge amount of work has been done to make sure that can't happen again, because everyone knows pilots regularly make mistakes, often a critical time of the flight from a safety perspective: landing.

3. How many times has an automated system shown better error correction performance that saved an aircraft vs a human being?

Until we have this data, the data we have suggests remote controlled aircraft or removing a pilot has the potential to be one of the most dangerous decisions to happen to civil aviation in the history of the industry.

[0] - https://dronewars.net/drone-crash-database/

[1] - https://en.wikipedia.org/wiki/List_of_accidents_and_incident...

The ones where the second pilot corrected the mistake are not shown on episodes of Aviation Disasters, because they are boring.

The first 737MAX MCAS incident you never hear about because there were 3 pilots in the cockpit, and one of them reached over and turned off the stab trim system.

Only because he already had been in an incident himself already the day before and knew what to do.

As a thought experiment, what would it be like to drive a car with: 10/50/100/200 ms of visual and input latency?

"Skin in the game" from Taleb argues that yes, it's because the pilot is in plane that the plane is safer. Because the pilot will pay the same price as the passengers for a mistake, it will increase the likelihood of success.

That’s a great point I hadn’t thought of

What if we just throw the remote pilot from a tall building in the event of a plane crash?

Killer drones main job is killing people, an airlines main job is keeping them alive...

I don't think the comparison to a drone that doesn't need a pilot on board applies to an airline. If there are humans on board, one or ideally more of them should be capable of controlling the aircraft.

Worst case scenario is if the drone crashes no one dies.

It’s skin in the game. A pilot in the cockpit will make sure all safety procedures are followed and correct because his life is literally at play. A pilot at land, not necessarily.

Drones fail all the time, so I wouldn't classify that as a success example.

The difference here is that if the drone fails then nothing really happens, the targets might even be spared lol, but if a commercial airplane fails then hundreds of lives could possibly be lost.

I don't think the airline industry is ready for that massive risk. It's already risky enough for them now.

I love that show. At some point in every episode the narrator says something to the effect of:

"Little did they know, that one small oversight would set off a cascade of failures that would seal their fate."

While the show is great, the dialog can be hilarious. "We have to find the cause. Let's check the flight voice recorder." (One always checks the voice recorder.)

Reply on news.ycombinator.com