
At Doomed Flight’s Helm, Pilots May Have Been Overwhelmed in Seconds - danso
https://www.nytimes.com/2018/11/08/world/asia/indonesia-plane-crash-last-moments.html
======
bodas
They say that most accidents are a sequence of several failures, but from
what's in this article it sure seems to me like 100% Boeing's fault.

If the only maintainence problem with this aircraft was a broken sensor, then
that is almost irrelevant because sensors can break during flight too.

If it's really true that a mere broken sensor can cause the computer to ram
the aircraft into the sea, then someone at Boeing really fucked up. Where are
the redundancies and sanity checks?

~~~
danso
From my complete layperson perspective, this flawed-sensor/autopilot failure
feels even more inexplicable than Tesla's Autopilot failing to stop for
stationary objects. In the latter case, I can grasp how it's difficult -- or
at least an open-ended problem to train a system to distinguish such objects
in real time. But the heuristics for stable flight seem much more bound to
hard-coded heuristics and physical facts -- isn't there a calculable, mostly-
predictable limit -- for any given altitude -- to how much a plane can correct
for a stall by nosediving. And when this limit is approached, shouldn't the
plane's autopilot cede more control to the human pilot, if there's no
indication that the pilot is otherwise incapacitated?

But it sounds like there's still a lot of unknowns about sensor readings and
chain of events -- for all we know, it's possible the plane made a reasonable
auto-correction, but the pilots misinterpreted the sensor readings and
inadvertently caused the plane to go into an uncontrollable dive. Given that
this is the Boeing 737 Max 8's first major crash, and it happens to be with
one of the most unsafe budget airlines, it seems premature to say Boeing is at
100% fault. OTOH, 1 crash/189 deaths of a new plane, of a model that has had
just 2 years of service so far, is not a statistic that justifies giving
Boeing the automatic benefit of the doubt.

edit: Also, the Lion Air plane was said to have had the same major glitch with
its airspeed indicator in all of its 4 final flights [0]. Even if Boeing's
design is found to have shortcomings, Lion Air choosing to _not_ ground the
plane despite 4 consecutive flights of buggy behavior is a huge indictment of
its safety culture.

[0]
[https://www.popularmechanics.com/flight/airlines/a24568956/l...](https://www.popularmechanics.com/flight/airlines/a24568956/lion-
air-flight-jh-160-red-flag/)

~~~
skgoa
> isn't there a calculable, mostly-predictable limit -- for any given altitude
> -- to how much a plane can correct for a stall by nosediving. And when this
> limit is approached, shouldn't the plane's autopilot cede more control to
> the human pilot, if there's no indication that the pilot is otherwise
> incapacitated?

There is, but there will always be a dependency on sensors to feed the input
values into these funcitons. Modern flight computers are far better at pretty
much any flying task than humans. Other than communicating wiht traffic
control and raising/lowering the flaps and gear (none of which are absolutely
necessary), a modern airliner can take off, cruise and land entirely on its
own, with no human intervention.

I agree that it's probably a combination of bad maintenance, a not quite
perfectly fault-tolerant system design and human error of the pilots. One
factor that hasn't been mentioned is that even the newest versions of the 737
contain ancient, obsolete technology. A newer airliner will probably have more
redundant and more fault-tolerant systems.

~~~
CPLX
> Other than communicating wiht traffic control and raising/lowering the flaps
> and gear (none of which are absolutely necessary), a modern airliner can
> take off, cruise and land entirely on its own, with no human intervention.

Yeah no. This is obvious patent nonsense.

Relevant: I am a licensed pilot

~~~
Retric
A single operator handles multiple military drones. A large part of this is
they can takeoff and fly to a specific location, and or land from a specific
location on their own.

Their are many reasons a 747 is not setup to do this is, but it’s not
technology that difficult. Ex:
[https://en.m.wikipedia.org/wiki/Autoland](https://en.m.wikipedia.org/wiki/Autoland)

~~~
danielvf
Just because other aircraft can to this today does not mean "a modern airliner
can". No modern airliner currently has the capability to make remote
controlled flights.

~~~
JoeAltmaier
Hm. Autopilots have been able to fly the whole plane for decades, from runway
to runway. They're not permitted for whatever reason; there has to be a pilot
in the seat. But honestly for most flights of airliners (not even just modern
ones) the autopilot is in control almost all of the time.

Can they be remotely operated? I'm thinking putting a plane into autopilot has
to be a remote operation by now. Its so trivial, how can they have left that
out?

~~~
mrguyorama
They can't and don't fly runway to runway by themselves because even the
smallest problem/perturbation/deviation from the norm knocks the plane out of
the higher levels of automation and requires a human to intervene. The
automation is great at making small adjustments to keep a plane flying stable,
but give it a complicated, unknown airframe and it would fail miserably

~~~
JoeAltmaier
CatIIIb can surely land, even with fog or other perturbations

~~~
mrguyorama
Fog yes, but one of the three redundant guidance units malfunctioning? No. In
fact, pretty much any hardware problem or malfunction will prohibit CatIIIb
landing, which is common in current aviation. Craft will regularly fly with
"minor" hardware or sensors in an inop status.

Basically to let the plane land itself, first the stars have to align

------
chopin
If I recall the prior discussion in HN correctly, the flight path was abnormal
well before the impact. This contradicts somewhat that it was a surprise nose
dive. Also, the pilot asked for return to the departure airport without
indicating an emergency. The last discussion speculated somewhat about unsafe
center of gravity which I found more convincing. We'll see.

------
Zak
It seems to me that aircraft with a lot of automation should have a single big
red button to turn it all off.

In most situations, of course, the automation is good, preventing pilot errors
like stalling or exceeding safe control inputs, but these are fundamentals
that every pilot learns in the first few hours of flight training. Unlike some
fighters that are inherently unstable, a 737 can be flown safely without the
computer overriding the pilot's control inputs so long as the pilot flies
reasonably.

I've had a similar experience in a car. Antilock brakes are designed to
override an erroneous control input: braking too hard for the available
traction. In the event of a wheel speed sensor malfunction, they can override
a reasonable control input: moderate braking well within the limits of the
available traction. This is _terrifying_ , and there's no way to override it
in the moment. It can, however be overridden in most cars by pulling out the
fuse for the ABS.

~~~
mnw21cam
There are risks associated with an aircraft having different operation "modes"
as well. For example, in
[https://en.wikipedia.org/wiki/Air_France_Flight_447](https://en.wikipedia.org/wiki/Air_France_Flight_447)
the aircraft detected that some of its sensors were no longer working, and
switched into a more manual mode of operation, with appropriate warnings to
the pilots. The pilots couldn't get their heads around this, and stalled the
plane into the sea.

~~~
Zak
No doubt, though I think a compounding factor here is the automatic switching
between modes. The pilots didn't seem to understand what the plane was doing
and why.

A reasonable response in that situation might be to hit the big red button,
removing any question about the behavior of the flight controls. It may not
have been enough in this scenario, as the pilots didn't seem to be paying
appropriate attention to the angle of attack indicator, which was apparently
functioning and clearly indicating a stall, but it may have put them in the
right frame of mind to correct the problem.

------
inamberclad
If this was an anti-stall manuver, wouldn't they have been given a cue from
the auditory warnings and the stick shaker as to what was about to happen? I
know that stick pushers (that literally take the yoke out of your hands) are
common on these aircraft, but I'd be surprised if it was actually so strong
that a human could not overcome it.

~~~
AmVess
Stick shakers aren't a fix. The pilot in the Colgan air accident kept pulling
back even though the plane activated the stick pusher; he kept pulling back
until that disengaged.

Even the best designed plane will eventually meet a pilot that can fly it out
of the air.

------
throwinterview
I find it weird that the article tries to blame everyone EXCEPT Boeing. This
appears to be clearly Boeing's fault and the article smells like a shoddy PR
damage control attempt.

~~~
peteretep
I want to add to that:

> “The problem is, the less-desirable airlines are the ones with the least
> resources that are scraping the bottom of the barrel in terms of human
> resources,” said Martin Craigs, the chairman of Aerospace Forum Asia, an
> industry advocacy group in Hong Kong.

Fuck you, NYTimes Journalist, for including this quote in a story that seems
to inescapably point at a combination of Boeing equipment failure and Lion
Air's upper management.

~~~
dmos62
Note: somewhere around the second paragraph I realised this is very indirectly
relevant, if at all.

I think poor working conditions in the Asian textile industry is a relevant
analogy.

A textile factory collapses due to inexcusabe management decisions or
incompetence. The management pulled the trigger, so to speak. However, it's
the abusive dynamic of the free-market that incentivised management to cut
costs to sustain the business. If they had not met the price offered by the
big brands, the contract would go to someone else, i.e. there's an abundance
of low-cost supply.

In the Asian textile market, the manufacturers, working at thin margins, are
incentivised to cut costs to unreasonable levels, because they'd lose
business. The local regulators are incentivised to not regulate, because the
demand would move to another jurisdiction.

My point is that sometimes, there's two sides to the guilty coin. There's the
isolated incident and the general atmosphere that breeds those incidents.

I can not relate this to the topic of Asian airlines, but you might find this
interesting nonetheless.

~~~
DoctorOetker
that doesn't make sense, surely the average airline customer prefers being
unable to afford a flight over dying in one.

inability to compete does not justify negligence

Edit: I agree with your remarks about the textile industry though, the
customer does not feel the death and destruction for the workers

------
platz
How bad was the problem of stalls that Boeing needed to add this aurocortect
feature, given that it has caused critical events on multiple occasions?

------
ThJ
I wonder if these aircraft contain any accelerometers, and if they do, how
many?

~~~
asdfasgasdgasdg
[https://www.youtube.com/watch?v=V9pvG_ZSnCc](https://www.youtube.com/watch?v=V9pvG_ZSnCc)

I don't know how much an accelerometer would help. See, you can be upside down
and still feel like gravity is pointing downward depending on the flight
conditions.

~~~
londons_explore
With an accelerometer and gyro, one can "dead reckon" to know the groundspeed
and angle of attack. Augment with GPS and those results can be near perfect.
Sign the GPS data and have a clock onboard the aircraft and it can't be
spoofed. Combine with weather predictions delivered from a satellite and I bet
you could get enough information to fly a plane with no external sensors at
all.

The whole "sensors were broken" thing should never be a reason for a plane to
crash if this alternate mode of flying is possible.

------
Balgair
Reading through the report via the NYT reminds me strongly of Junger's _The
Perfect Storm_ and it's description of the last minutes of the Jolly 110.
Specifically: Task-Saturation.

For reference to set-up the situation[0]:

"On 30 Oct. 1991, United States Air Force Sikorsky HH-60G Pave Hawk, assigned
to the 106th Rescue Wing, nicknamed the Jolly 110, New York Air National
Guard, headed out into a hurricane that would become known as “The Perfect
Storm.” Aboard were Major C. David Ruvola, pilot; Captain Graham Buschor, co-
pilot; Staff Sergeant James R. Mioli, flight engineer; and pararescue jumpers
Technical Sergeant John Spillane and Technical Sergeant Arden Rick Smith.
Their mission was to attempt a rescue 250 miles (400 km) out to sea.

Due to the severity of the storm—a weather buoy located 264 miles (425 km)
south of Halifax, Nova Scotia, reported a wave height of 100.7 ft (30.7 m) on
30 Oct., the highest ever recorded in that part of the Atlantic Ocean—the Pave
Hawk crew was unable to make the rescue and had to return to their base.

Having already refueled from the Lockheed HC-130 Hercules tanker three times
during the mission, and with low fuel, a fourth refueling was needed for the
helicopter to make it back to the mainland. Because of the the extreme
turbulence and lack of visibility, Jolly 110 could not make contact with the
refueling drogue trailing behind the airplane.

Major Ruvola made more than 30 attempts, but finally both drogues had been
damaged by the severe conditions. With just twenty minutes of fuel remaining,
Jolly 110 would have to ditch in the middle of “The Perfect Storm.”"

Now, from _The Perfect Storm_ :

"Ruvola finally breaks out of the clouds at 9:28, only two hundred feet above
the ocean. He goes into a hover and immediately calls for the ditching
checklist, which prepares the crew to abandon the aircraft. They have
practiced this dozens of times in training, but things are happening so fast
that the routines start to fall apart.(Aside: for a good look into the _utter
chaos_ of helicopter underwater egress, see this video from SmaterEveryday[1])
Jim Mioli has trouble seeing in the dim cabin lighting used with the night
vision gear, so he can't locate the handle of the nine-man life raft. By the
time he finds it, he doesn't have time to put on his Mustang survival suit.
Ruvola calls three times for Mioli to read him the ditching checklist, but
Mioli is too busy to answer him, so Ruvola has to go through it by memory. One
of the most important things on the list is for the pilot to reach down and
eject his door, but Ruvola is working too hard to remove his hands from the
controls. In military terminology he has become 'task saturated' and the door
stays on. " (pg 184, _The Perfect Storm_ , S. Junger)

Now, those Lion Air pilots had better weather, much better, but the time in
which they had to react was much less. Though I know nothing about how those
cockpits are set-up and what the protocols are, there is a strange similarity
to the Jolly 110 ditching and 'Task Saturation'.

[0]
[https://www.thisdayinaviation.com/30-october-1991/](https://www.thisdayinaviation.com/30-october-1991/)

[1]
[https://www.youtube.com/watch?v=-53kaP6dZeI](https://www.youtube.com/watch?v=-53kaP6dZeI)

