The Lion Air 610 mystery/tragedy seems to be mostly solved. The Boeing 737 MAX 8 airplane, which uses a de Havilland Comet (1949; also BBC)-style hydro-mechanical flight control system, has a touch of intelligent software layered on top. This NYT article and an Emergency Airworthiness Directive #2018-23-51 explain how the airplane will trim itself into a crazy nose-down attitude in the event of a single angle-of-attack (AOA) sensor going bad.
“At Doomed Flight’s Helm, Pilots May Have Been Overwhelmed in Seconds” (nytimes) explains
[disabling the system] would not have been a simple matter of pushing a button. Instead, pilots said, Captain Suneja could have braced his feet on the dashboard and yanked the yoke, or control wheel, back with all his strength. Or he could have undertaken a four-step process to shut off power to electric motors in the aircraft’s tail that were wrongly causing the plane’s nose to pitch downward.
Can we consider this the first mass killing by software?
[Background: an airplane wing will suffer an aerodynamic stall, in which the airflow over the top of the wing is no longer smooth, and lose Bernoulli effect lift, if the angle between the relative wind and the wing is too large. This is what limits an airplane’s ability to hover. To generate sufficient lift, the wing has to be within about 12 degrees of level and the wing needs to keep moving. It isn’t possible to fly super slowly at a 45-degree nose-up angle and still have enough lift to remain at the same altitude. The helicopter works by spinning a conventional airfoil so that, even if the fuselage isn’t moving, the wing is still moving rapidly and generating lift.]
What are some alternatives to Boeing’s design, you might ask? The Airbus philosophy, as embodied in the A320 and subsequent airliners, is to turn everything over to the computer(s). Despite holding the stick all the way back, Captain Sully was not able to stall the A320 that landed in the Hudson River. If the fancy computers on an Airbus aren’t getting what they think is good or consistent data from the various sensors, they hand over the machine to the pilot who can look out the window or at the attitude indicators in the cockpit and do something sensible (or panic like a student pilot, as with Air France 447).
Stepping down the food chain, we have the Pilatus PC-12, a Swiss-designed 11-seat turboprop. The plane starts out with a standard light aircraft flight control system. The pilots’ yokes are connected directly to control surfaces via pushrods and cables. On top of this Pilatus has layered a stick shaker to warn pilots that the airplane is nearing a stall and a stick pusher that yanks the yoke forward. The airplane has a great safety record despite being operated into some challenging short runways and being flown, in some cases, by inexperienced pilots.
Instead of Boeing’s single AOA sensor and software to run the trim, the PC-12 has two AOA sensors and two computers. If both sides agree that it is time to go nose-down, then and only then will the stick pusher be engaged. If somehow both sensors and both computers are defective and push inappropriately, a “pusher interrupt” button is always right there on each yoke. From the AFM (“owner’s manual”):
A friend who is a Silicon Valley engineer texted me incredulously “Wouldn’t they do fusion from zillions of sensors?” My response on the FAA certification process:
It is like ISO 9000. Boeing had binders of paperwork and bureaucratic approval for their design, but the design itself may never be scrutinized.
Almost certainly if the B737 had the same system design as the PC-12 all 189 folks aboard Lion Air 610 would have arrived safely at their destination. The worst that would have happened is the pilots being briefly annoyed by a shaking stick and having to hit a checklist.
I’m not sure if this crash can fairly be attributed to a software problem, since the software presumably did function as designed. It seems that we can attribute the crash to a poor system design, but ultimately the plane was crashed into the water by software.
- Wikipedia has a good article on the various aircraft flight control system alternatives