Hacker News Reader

Comment by logfromblammo | Hacker News Reader

"Our automated system crashed several planes, when the pilots were not able to disable it before it could erroneously trim the vehicle into terrain.

"Clearly, we need to remove the human pilots and double down on the automation."

[This is where the people using shallow analysis go nuts. But wait.]

Because the flawed system was only installed for the purpose of avoiding the expense of retraining human pilots to a new model of aircraft! In a fully-integrated automated piloting system, there is no separate trim-compensating subsystem. The trim parameters are plugged directly into the aircraft model, and the automatic pilot has access to all the sensors in the craft to make its trim decisions, instead of just the angle-of-attack sensor.

Instead of re-certifying hundreds of pilots, you just validate one new aircraft data model.

View on HN

And with the design that both Boeing and the FAA certified to fly, that system would simply fly the vehicle into terrain. In this case it is exactly the automation that is at fault, not a pilot misunderstanding or mistraining. The automation system was designed to prevent a pilot from doing something she might have been familiar with doing while flying the old design on the new design. It was designed to keep the pilot from putting the plane in a bad state for flying. That entire system made an error that cost 347 people their lives.

What is painful, is that the pilots recognized that the system was in error, and attempted to correct it, but were unaware that it had the capability to override them. They were unaware because the designers intentionally hid the mechanism. That is made the mechanism hard to see, understand, and needing special knowledge to disable. The designers had not considered all failure modes, but acted as if their implementation was failure-proof and never to be tampered with.

The question in this case is how can one verify something like an automated aircraft system? And more importantly, if there is a technique or practice to assure the system is valid, is the company trying to build it mature enough in its engineering practices to follow it properly?

Every aircraft-building company is mature enough in its engineering practices. Not every company is ethical enough in its management practices.

>> Because the flawed system was only installed for the purpose of avoiding the expense of retraining human pilots to a new model of aircraft!

I'm not sure that's the only reason. Otherwise they should have started building them without MCAS and retraining pilots several months ago. That seems far simpler/cheaper than whatever they're doing now.

They should have put the new engines on a new airframe with more ground clearance under the wings, that would not have required the heavy engines to be pushed forward and change the center of gravity in order to fit.

Such an aircraft would no longer be considered a 737 for the purposes of pilot certification.

The whole thing was motivated by that. Pretend it's the same plane, so that the pilots can pretend to know how to fly it.

It's analogous to hiring a Java or C# applications software developer when your codebase is actually in a proprietary variant of C++. It's close enough that they think they can code in it, but no one ever mentioned how the memory management subsystem is actually just a library written by Dave, who left the company in 2004, and if you aren't careful to clean up your references correctly (according to Dave), the biweekly analysis run will crash-to-desktop in the 14th hour, and you will be called by a panicked twentysomething at 5 AM on a Saturday. Then you find out about the custom compiler (also Dave), and start sending out resumes before it's too late. But with pilots, there's no one else to send the resume to.

Reply on news.ycombinator.com