Can someone explain how a hugely complex machine with mostly parallel working analog parts fits into the digital computing paradigm? Isn't it predetermined to fail under extreme conditions, like those that are found while flying inbetween clouds and thunderstorms with all that pressure and fluctuations? How does sampling not fail, like, all the time? What kind of tooling is being used to mitigate for all these? Does anyone know?
back
3 comments
I am very naive to commercial aviation but this is my experience with building and crashing model aircraft repeatedly. I fly mostly FPV which puts me in the first person view from the cockpit.
Yes, electronics fail in the most weirdest ways due to connector failures, RF interference, software error, sensor failure.
When my systems start failing or acting up due to improper stabilization PID gains, etc. I have a big switch for MANUAL mode. I am able to fly this thing as long as the servos, radio, and camera get power. All sensors could be sheared off. I have no idea what my airspeed is ever because I don't use pitot tubes so I use a known engine throttle % whose stall characteristic I understand for level flight in various wind conditions and I don't make sudden maneuvers at throttle below this point.
Fixed wing planes have remarkable aerodynamic stability and I don't understand why 737 MAX cannot be piloted in a fly by wire manner with all computer aids disabled, giving the pilots direct control of the servos with a big red switch that mechanically disconnects the flight computers. This requires almost no code to implement.
On Boeing aircraft, the pilots essentially do have "direct control of the servos" at all times. MCAS was implemented to make the MAX fly just like the NG despite the difference in engine size and placement. What MCAS actually did was not modifying the pilots inputs, but adjusting the stabilizer trim in certain scenarios.
The pilots do have direct control over the stabilizer trim, and have always had the ability to disable the electronic system in case of stabilizer trim runaway. This was not new to the MAX, and would have effectively disabled MCAS.
> What MCAS actually did was not modifying the pilots inputs, but adjusting the stabilizer trim in certain scenarios.
But MCAS had enough control authority to override the pilots' inputs; the pilots of both crashed aircraft were desperately trying to pull the nose up, but couldn't because MCAS had put in so much nose down trim that they couldn't counteract it.
> The pilots do have direct control over the stabilizer trim, and have always had the ability to disable the electronic system in case of stabilizer trim runaway. This was not new to the MAX, and would have effectively disabled MCAS.
The ability to disable the automatic stabilizer trim system was not new to the MAX, yes.
What was new to the MAX was that, unlike previous 737s, disabling the automatic stabilizer trim system would also disable the manual electric stabilizer trim system, so that the only way to adjust the trim would be by using the mechanical trim wheel. And it was possible for MCAS to adjust the trim into a range where it was mechanically impossible to adjust it back using the mechanical trim wheel.
Pilots do not have direct servo control of the aircraft if there is any possibility of any computer system adjusting the servos aside from the throw commanded by the sticks held by the pilot.
Reading comments such as:
> The problem was that an indicator light, designed to warn of a malfunction by a system that helps raise and lower the plane’s nose, was turning on when it wasn’t supposed to, the company said.
Implies that there is intrinsically some computer system that continually parses the commanded stick deflection and applies an overlay.
What I am suggesting is a single toggle to make everything shut up and reset all servos to their midpoint all at once in one shot and let the pilot just fly the plane.
I have not seen any evidence that such a system exists. It is the elephant in the room. Airplanes do not need complex electronics to just fly if they are aerodynamically stable, and this plane is more or less stable except that under some conditions it will make the pilot soil their pants at higher AoA, which is where the promises of MCAS come in. Big deal. They can mentally compensate against that manually better than fighting a computer system working actively against your commanded inputs.
I have experienced the joy of a badly tuned PID controller turning my stabilization system into involuntary high speed descent. The fix is always to tell the computer to shut up and just fly the plane 100% manually.
> Implies that there is intrinsically some computer system that continually parses the commanded stick deflection and applies an overlay.
That's not how the 737 works. The 737 is not a fly by wire aircraft. The pilots control the rudder, ailerons, and elevators electrohydraulically; there is no computer filtering. The electric stability trim system, which is what MCAS feeds its input into, controls the trim tabs on the elevators. This does not change anything about the pilots' inputs to the elevators, but it does change the aerodynamics of the elevators in a way that can limit the pilots' ability to control pitch.
> this plane is more or less stable except that under some conditions it will make the pilot soil their pants at higher AoA, which is where the promises of MCAS come in. Big deal.
If the 737 MAX had been a new aircraft type, it would not have been a problem. There might still have been some adjustment needed to meet FAA certification requirements for stick force (basically, the stick force is supposed to increase with increasing angle of attack, so the pilot has to pull harder to keep the nose going up as you get closer to a stall). But there would not have been a need to cobble together anything like MCAS.
The problem was that Boeing wanted the 737 MAX to be certified under the existing 737 type certificate (because otherwise the potential customers wouldn't want it, since they didn't want to have to re-train and re-certify all their pilots), which meant that the stick force as a function of angle of attack had to be the same as for previous 737s. But the new engines on the 737 MAX made the plane aerodynamically different, so the "natural" stick force was different. MCAS was a software kludge to try to change the stick force.
>If the 737 MAX had been a new aircraft type, it would not have been a problem.
If the aircraft was a new type this still would have been an issue that would have to be corrected, see FARS 25.173.
Yes, which is why I said: "There might still have been some adjustment needed to meet FAA certification requirements for stick force"
Good point
> Fixed wing planes have remarkable aerodynamic stability and I don't understand why 737 MAX cannot be piloted in a fly by wire manner with all computer aids disabled
It can be. MCAS can be disabled by disabling the electric stability trim system. The problem is that if you do that in a situation where MCAS has already adjusted the trim far enough from where it should be, it can be mechanically impossible to put the trim back where it belongs without using the electric trim system. So you have to first use the electric trim system to put the trim back where it belongs, then disable it so MCAS can't mess it up again.
Fly by wire = flying with computational assistance, not literally pulling wires, since control surfaces are hydraulically actuated.
https://en.wikipedia.org/wiki/Failure_mode_and_effects_analy...
https://en.wikipedia.org/wiki/Fault_tree_analysis
Basically, you should be designing every system to gracefully handle the failure of every other system on which it is dependent.
So the MCAS routines, if they had been done correctly, and properly classified as to the hazard level, should have taken into account failures of the Flight Computer they were running on, anomaly detection via cross-check with the second AoA vane, etc. That quite clearly did not happen.
The same approach applies with any other hardware/software integration. Your sensors will break. You therefore need to determine what you need to do when that happens.
Yes.