WRONG and WRONG.
In the first instance, the bird strike that ended up in the Hudson the flight control system was telling the pilot to take a flight path that would have resulted in the 'plane ending up buying a large chunk of the real-estate, the FLIGHT CREW turned the auto-system OFF, and the manually flew the plane to a successful, if rather wet, landing in the river. The flight crew were informed by way of their fully adequate training and flight manuals that the automated systems could be totally isolated quite simply from where they sat, and, as part of their training had to do so.
We know so little about the Moscow bird strike, but one thing is certain, until the aircraft is flying above a certain speed and altitude it is the flight crew that makes the calls, and the acts on them -they raised the undercarriage in the few seconds they had available to them before the 'plane that was just about flying (barely above V1) with no power arrived in that corn field.
In both cases the FLIGHT CREW were making the decisions and enacting them.

From memory, the Airbus family fly by wire system has at least three modes of operation - "fully automated", this is used during "level flight"; "pilot augmentation", in this mode the control system does things like power management, level and speed control, this is normally used for decent to just prior to landing; "pilot direct", this is where the automated system is out of the loop, and the pilot inputs directly affect all the flight controls. In addition to this is the "Madame Airbus"(*) flight and aircraft monitoring system, this is a "nag" system that notifies the flight crew of the aircraft status, giving various alarms and warnings, getting more "panicked" in both tone and message nature the more hazardous the situation from the very benign "V1, V2" through "approaching stall" to "stall in progress" and "ground contact imminent" (these are only examples, not the full repertoire).
The stick feel and command effect are modulated to reflect the speed, altitude, attitude and control mode (remember these aircraft are side-stick control not center-yolk).

So, during take-off to a flaps reduced the pilot inputs do all the control, once the flaps have been reduced to a certainly level, and the speed is above a level entered by the flight crew as part of their aircraft pre-flight set-up, but never below v2-max, the pilot can now hand over control to either the augmented mode or the fully automatic mode.


(*) Madame Airbus is one of the more polite names used by flight crews for this system. Language, sex and accent can be configured to suit the flight crew - normally the flight crew will use their own language (the repertoire is quite limited), but a sex and accent that contrasts with their own so it stands out in the cockpit - for example I know of a number of Air France crews who choose a British accent speaking French, while BA crews will choose a French accent speaking English.

---

Bob Smith
Member of Seti PIPPS (Pluto is a Planet Protest Society)
Somewhere in the (un)known Universe?

In both cases the FLIGHT CREW were making the decisions and enacting them.

In other words. they were in total command, not the software/technology. :-)
Could the software/technology as it stands today, do a better job?

In both cases the FLIGHT CREW were making the decisions and enacting them.

In other words. they were in total command, not the software/technology. :-)

Nope. Software reads the position of the controls in the cockpit and then sends commands to pumps and motors. Software is in total control of the positions of everything. Hacked software can do any damn thing it wants to. This is what people refuse to accept. They somehow think the disconnect button magically makes the controls operate like cables and push rods. Nonsense. The software does exactly what the program tells it to do. So if the software is programmed to deploy the left speed brake on gear up switch, it will deploy the left speed brake on gear up switch. How is the pilot in control then? Now if the pilot uses the emergency gear system, then he is in control as that is an all mechanical system.

Most of the time the software creates the illusion the pilot is in control, but it is an illusion. <MAX broke that illusion>

Back in the much older flight control systems they operated much more like the power steering in a car. Moving the control, physically opened a valve and hydraulic fluid pushed a cylinder moving the control. Not today in a glass cockpit. Software reads the position of the control, an electric signal is sent to a solenoid to open a valve ... a sensor on the control reads the position and the software reads it and stops sending the electric signal to the solenoid and the valve closes. You may wish to not think of the software being in control, but it is.

Most of the time the software creates the illusion the pilot is in control, but it is an illusion. <MAX Boeing broke that illusion>

There you go, fixed your error. Now maybe Boeing can "fix" MCAS just as quick. :-)

At LOW speed the pilot is in control, the Flight Control software is out of the control loop - it only becomes available to the pilot above a certain speed and flight configuration which hadn't been reached. Both the crashes you refer to were low speed. In particular the Moscow one, where I'm amazed that the plane actually managed to get off the ground given how close to V1 the second strike was. On the other-hand given the hyper-critical wing Airbus use maybe I shouldn't be so surprised as those wings fly at some very stupid low speeds and crazy high alpha.
In many respects the Moscow crash is very similar (aerodynamically) to the BA 777 at Heathrow - both engines lost at below safe recovery speed and were "landed safely" by pilots with cool heads and quick thinking, and in both cases the casualty rate was way below what might be expected. (Aside, my brother was a witness to the BA 777 "landing").
I suspect any member of the B737 family suffering a two engine failure at the same point in its take-off would have fared just as well, given pilots of similar caliber and level-headedness (which I think is beaten into airline pilots during their training).

You talk about "the software", but there is no "the software", but a whole set of computers and hardwires forming a complex set of system which are integrated into the overall system called "an aircraft". On on Airbus there are three separate sets of Fight Control Software, voting and monitoring systems, logging systems - then there are the control actuator systems (each at least duplicate, and each with monitoring and logging). Then there are the pilot control systems, which includes the inputs from the stick & rudder peddles, trim controls etc., again at least duplicate with logging and monitoring; plus the hardwire direct links to the actuators controls which allow the pilot to fly the plane if all the main networks are out or the pilot has decided to hand fly and during take-off. From memory each pilot joystick has more computing power than the whole FCC on a B737, and it still has a hardwire output from the motion and position sensors "just to make sure". (Most, if not all, the "linear" hardwire systems are duplicate restricted valid range PWM signals, whereas a lot of control systems use "full range" PWM signals - restricted range means that if the signal gets inverted for whatever reason it becomes "invalid" without the need for a voting comparator at the receiving end.)

---

Bob Smith
Member of Seti PIPPS (Pluto is a Planet Protest Society)
Somewhere in the (un)known Universe?

The software does exactly what the program tells it to do.

Oh dear. Software does only what the program developer tells it to do. Which means that since system developers are only humans and can make mistakes sh*t sometimes happen. Simple as that. That's why testing is so necessary. Boeing in this case thought it was a minor problem and could easily be fixed with some updates. Now has Boeing managed to fix the MCAS problem to this date?

All the talk about software/hardware/computers etc, even though valid enough is nothing short of laughable. Software writers/hardware manufacturers do not certify their products for flight, that is down to the aircraft assembler to ensure that the completed aircraft is fit for flight & that includes both software & hardware.

Boeing & not the code writers or hardware manufacturers downplayed the issues to avoid expensive type re-certification - that is the heart of Boeings current issues. Yes the FAA is also culpable in this matter.

At least Canada has started the ball rolling in deciding to work more closer with European Aviation Authorities than just having to accept anything the FAA says or does.

How long before other countries follow Canada's lead & at what expense to Boeing & reputation of the "acclaimed "FAA?

At LOW speed the pilot is in control, the Flight Control software is out of the control loop - it only becomes available to the pilot above a certain speed and flight configuration which hadn't been reached. Both the crashes you refer to were low speed. In particular the Moscow one, where I'm amazed that the plane actually managed to get off the ground given how close to V1 the second strike was. On the other-hand given the hyper-critical wing Airbus use maybe I shouldn't be so surprised as those wings fly at some very stupid low speeds and crazy high alpha.
In many respects the Moscow crash is very similar (aerodynamically) to the BA 777 at Heathrow - both engines lost at below safe recovery speed and were "landed safely" by pilots with cool heads and quick thinking, and in both cases the casualty rate was way below what might be expected. (Aside, my brother was a witness to the BA 777 "landing").
I suspect any member of the B737 family suffering a two engine failure at the same point in its take-off would have fared just as well, given pilots of similar caliber and level-headedness (which I think is beaten into airline pilots during their training).

You talk about "the software", but there is no "the software", but a whole set of computers and hardwires forming a complex set of system which are integrated into the overall system called "an aircraft". On on Airbus there are three separate sets of Fight Control Software, voting and monitoring systems, logging systems - then there are the control actuator systems (each at least duplicate, and each with monitoring and logging). Then there are the pilot control systems, which includes the inputs from the stick & rudder peddles, trim controls etc., again at least duplicate with logging and monitoring; plus the hardwire direct links to the actuators controls which allow the pilot to fly the plane if all the main networks are out or the pilot has decided to hand fly and during take-off. From memory each pilot joystick has more computing power than the whole FCC on a B737, and it still has a hardwire output from the motion and position sensors "just to make sure". (Most, if not all, the "linear" hardwire systems are duplicate restricted valid range PWM signals, whereas a lot of control systems use "full range" PWM signals - restricted range means that if the signal gets inverted for whatever reason it becomes "invalid" without the need for a voting comparator at the receiving end.)

By Flight Control Software you mean autopilot functions? On the ground, brakes locked, you do a controls check, just to be sure the right thing moves the right way when the stick is moved. Pulling the the stick doesn't move the control. It moves a sensor and a signal giving the sensor position and is read by a computer (possibly more than one) and the computer sends a signal to actuators to move a flight control surface and there are sensors on the flight control surface to read the position and stop movement at the "desired" er "software selected" angle. If this computer is single function of multi function, analog or digital doesn't matter, it is still a computer. It isn't a mechanical connection. I know it is allegedly programed to give the illusion of being a mechanical connection. If it is a analog computer, it is going to be next to impossible to hack. If it is digital, it can be hacked and a different program substituted. The pilot is in control only if and only if the software/hardware allows it.

As to "the software," it is all the different bits of code running on all the different computers which forms that complex system. Not any different conceptually than a distributed database system that does remote procedure calls from box to box over a network or thread to thread on the same cpu to work.

The user manual, for pilots, is going to present it as separate functional black boxes. The service manual for A&P's is going to have to present it much more as it is implemented with many functions running on a single box. The designers documents, internal, will have it laid out as it actually runs with source code.

The hard part for most to accept is that about the only control that can't be overridden with hacked software is the circuit breaker.

Now as to that PWM, how is invalid decided?
if (PWM < Limit) trust_PWM() else do_fail();
A hacker can overwrite that check with a no-op. The world needs to wake up to just how incredibly vulnerable they are to malicious actors.
By the way, how do you think Stuxnet worked? It overwrote limit checks!

The world needs to wake up to just how incredibly vulnerable they are to malicious actors.

Maybe, but it really does need to wake up to the fact that chasing "fiduciary duty" is getting too extreme.
The best example of that was Bernie's reply to my post regarding the US Navy:

Yes and this stood out for me

"The control systems were "overly complex" because shipbuilders had little official guidance on how they should work.
As a result, he said, the control systems on different ships had little in common, so sailors often were not sure where key indicators, such as a ship's heading, could be found on screens."

The Navy had no input as to the design of the control system interfaces, good grief!!

Cheaper to pay the fines is what also needs to be rectified.
Make the fines extremely expensive & applicable per fatality, then that thought will disappear.

The world needs to wake up to just how incredibly vulnerable they are to malicious actors.

Maybe, but it really does need to wake up to the fact that chasing "fiduciary duty" is getting too extreme.
The best example of that was Bernie's reply to my post regarding the US Navy:

Yes and this stood out for me

"The control systems were "overly complex" because shipbuilders had little official guidance on how they should work.
As a result, he said, the control systems on different ships had little in common, so sailors often were not sure where key indicators, such as a ship's heading, could be found on screens."

The Navy had no input as to the design of the control system interfaces, good grief!!

Cheaper to pay the fines is what also needs to be rectified.
Make the fines extremely expensive & applicable per fatality, then that thought will disappear.

USN not having input is SOP for the idiots who write government contracts. If you want to see the real end of that, look at Apollo era contracts. Of course no one had any idea before it was built what it should have looked like. Surface ship controls should be a bit more standardized, they have been around for a while. However it wouldn't surprise me at all to find each shipbuilder doing it "their way." Not much different than say cladding on tower blocks. Someone has to write a standards manual before there are standards! BTW back on airplanes, there is no official standard on where each indicator belongs on the instrument panel in front of the pilot. They have just been built for so long that everybody tends to place the things in similar places out of habit.

Now as to that PWM, how is invalid decided?
if (PWM < Limit) trust_PWM() else do_fail();
A hacker can overwrite that check with a no-op. The world needs to wake up to just how incredibly vulnerable they are to malicious actors.
By the way, how do you think Stuxnet worked? It overwrote limit checks!

That shows your lack of understanding - the voting and detection systems are hardware. For a PWM detector one integrates the signal then use a voltage comparator to get the digital pass/fail status, the pass/fail status is the used to either block or allow the signal to go to the actuator control. Similarly the voting systems are hardware - they use one-way data or hardware digital or analogue input channels do the voting using hardware n-way devices and then pass the valid results to the actuator.

Stuxnet, and other similar approaches, fail when you have this hardware wall in the way - unless one ca physically get to the voting hardware you can't change it's logic. Also remember that many (ground based) SCADA systems were designed a long time before hackers were thought a threat, but Airbus were considering failures of their computer systems (control input, control output and data (analogue or digital) as part of their design philosophy not as an add-on.

---

Bob Smith
Member of Seti PIPPS (Pluto is a Planet Protest Society)
Somewhere in the (un)known Universe?

By Flight Control Software you mean autopilot functions
FCS includes autopilot functions, but a lot more besides - things like fuel and fluids management (this helps with the trim) are all part of the FCS system - and software is only part of it, hence SYSTEM.

---

Bob Smith
Member of Seti PIPPS (Pluto is a Planet Protest Society)
Somewhere in the (un)known Universe?

Now as to that PWM, how is invalid decided?
if (PWM < Limit) trust_PWM() else do_fail();
A hacker can overwrite that check with a no-op. The world needs to wake up to just how incredibly vulnerable they are to malicious actors.
By the way, how do you think Stuxnet worked? It overwrote limit checks!

That shows your lack of understanding - the voting and detection systems are hardware.

An analog computer, so change the value of limit.

For a PWM detector one integrates the signal then use a voltage comparator to get the digital pass/fail status,

And how is the comparison voltage generated?

the pass/fail status is the used to either block or allow the signal to go to the actuator control.

so a bad actor could prevent any signal being passed by constantly holding an invalid value. Or if he can get to the comparison voltage, setting it to an impossible level.

Similarly the voting systems are hardware - they use one-way data or hardware digital or analogue input channels do the voting using hardware n-way devices and then pass the valid results to the actuator.

Again analog or digital computers.

Stuxnet, and other similar approaches, fail when you have this hardware wall in the way - unless one ca physically get to the voting hardware you can't change it's logic.

May or may not depending on if the system has a mode where it is programmed (flashed) for its use. And there is nothing preventing the virus from getting into all the input computers so it will vote valid.

Also remember that many (ground based) SCADA systems were designed a long time before hackers were thought a threat, but Airbus were considering failures of their computer systems (control input, control output and data (analogue or digital) as part of their design philosophy not as an add-on.

As I said several posts ago, analog computers are much harder to mess with.

What you fail to realize is to take over the airplane, you simply need to instruct the computer(s) to ignore pilot input. There is no need to supply invalid output to do so. The pilot of course can pull breakers on the computers, but can he pull all of them? or does he need at least one to fly?

You perhaps need to think about this from the level of a state bad actor. They have an Airbus on a test stand in a wind tunnel, all the manuals - even the internal ones which they got from breaking into the manufacturers design systems, and are hacking at it. It won't take them long to find a way (several) to take over. The real question is can they do so without bribing a maintenance person to plug in a flash drive in the avionics bay, leave it for a couple of minutes and then take it with him. If they find a way to only need to plug a flash drive or a raspberry pi into the entertainment system ....

A state actor would first disable all the nags, indicators and warning systems so as to not draw attention. Next they likely would slowly raise cabin altitude. If they did this before the altitude where one pilot must be on a mask now there aren't humans attempting to regain control. Then climb to service ceiling and no pressurization or heat while on course for the target. At target descend at Vne. Splat. Of course for a state actor a drone filled with explosives is likely cheaper but there is less deniability for that and more chance of it being shot down. <ed - of course the real target could be a person who is onboard>

No, not an analogue computer, but a very simple bit of logic that is probably far beyond your low level of understanding. Simple voltage comparators, and simple discrete logic devices.
How are the reference voltages derived? - simple reference voltage generators - they don't need to be high precision as the valid ranges of the PWM signals have been selected such to give a wide "out of range, probably wrong" band.
No "bad actor" can even get close to these voting systems - this was DESIGNED IN at a very early stage in the process - these system are NOT CAPABLE of being reprogrammed. PERIOD. They are small PCBs with full of op-amps, diodes, resistors capacitors, and discrete logic devices (several generations on from the good old 74xx devices of old) not a programmable device in sight, and they are connected directly by wires (not data buses) or PCB tracks to the drive electronics for the hydraulic actuators.

---

Bob Smith
Member of Seti PIPPS (Pluto is a Planet Protest Society)
Somewhere in the (un)known Universe?

From its initial commercial flight to the grounding, there was a total of 8,600 flights.
On some of those flights, problems occurred with MCAS & it was deactivated.
I'm not a pilot so colour me dumb.
Is the trim system required for landing? If yes, how did those pilots who deactivated MCAS land the aircraft?

As in the case of the USN & shipbuilders, why aren't control systems standardised?

Copy & paste doesn't seem to work on the site I'm using for my comments.
Source

From its initial commercial flight to the grounding, there was a total of 8,600 flights.
On some of those flights, problems occurred with MCAS & it was deactivated.
I'm not a pilot so colour me dumb.
Is the trim system required for landing? If yes, how did those pilots who deactivated MCAS land the aircraft?

The aircraft trim should be maintained at all times. Not doing so reduces the safe control envelope for the pilot.

Deactivating the electrical controlled trim means the pilots must do more work to manually adjust the trim.

So yes, an aircraft can safely land with the pilots using manual trim.


Except... I have my own personal concerns for the Boeing 737 MAX aircraft in that:

Without the brute force action of MCAS, the new oversized engines and the aerodynamics of the engine nacelles may well reduce the control authority for the pilots, especially so when maneuvering for such as landing and takeoff...

I do wonder whether the Boeing 737 MAX can recover from all stall scenarios without the aid of MCAS kicking in...?

As in the case of the USN & shipbuilders, why aren't control systems standardised?

Copy & paste doesn't seem to work on the site I'm using for my comments.
Southwest is adding new angle of attack indicators to its 737 Max fleet

Note:

"Southwest is adding new angle of attack indicators to its 737 Max fleet - The AOA indicator will provide a valuable supplemental cross-check in the event there is an erroneous AOA signal present"

That is only adding "IN YER FACE!" 'indicators' that the AOA sensors are judged to be faulty.

There is no fix to add triple redundancy for those sensors.


So far, in my humble uneducated ill-informed amateur personal opinion, Boeing are merely covering the symptoms with what should have been implemented in the first place. They are still doing nothing about the source problems to avoid failure in the first place. They are still relying on the pilots to patch over their design and implementation cost cutting deficiencies...


All in our only one world,
Martin

---

See new freedom: Mageia Linux
Take a look for yourself: Linux Format
The Future is what We all make IT (GPLv3)

The aircraft trim should be maintained at all times. Not doing so reduces the safe control envelope for the pilot.
Deactivating the electrical controlled trim means the pilots must do more work to manually adjust the trim.
So yes, an aircraft can safely land with the pilots using manual trim.

I thought it might be. However, how many pilots are of the Jeff Capes or Arnold Schwarzenegger type?

Not being funny, but I thought of my post above (& this one to a degree) after watching the video in your post 2002888

Rob, an OP amp is a analog computer. Sorry you are so misinformed.

Rob, an OP amp is a analog computer. Sorry you are so misinformed.

Gary,

Why the silly word-play?

Please note that "OP amp" is the abbreviation for "Operational Amplifier" and is a general purpose unit/component that is used in various electronic systems, including (but not exclusively so,) analog computers.

Also note that in today's "Digital Age", we usually use digital techniques for computation, signal processing and control.

Further note that op-amps are readily used to compare two signal levels and so offer a minimalist way to generate a digital indication for whether an analog input signal is "out of bounds" or not. There are specially characterised/specced op-amps purely for that function called "comparators". However, that function can also be performed by a simple two transistor "long tailed pair" circuit... And 'minimalist' is often reliable and robust (assuming good design of the surrounding circuitry!)...

I certainly wouldn't call a single op-amp an analog computer!


Now, back to the actual useful discussion...

All in our only one world,
Martin

Aside: Wikipedia makes for some wonderful reading if you have the inclination to investigate ;-)

---

See new freedom: Mageia Linux
Take a look for yourself: Linux Format
The Future is what We all make IT (GPLv3)

Here's a worrying Boeing 737 MAX mystery that I've not been able to find anything further about on various web searches:


Additional Software Problem Found In Boeing 737 Max Control System

Boeing confirmed to The Washington Post that it had found a second software problem that the Federal Aviation Administration has ordered fixed - separate from the anti-stall system under investigation in the two crashes...

That additional problem pertains to software affecting flaps and other flight stabilization hardware and is therefore classified as critical to flight safety, said two officials who spoke on condition of anonymity to discuss the ongoing probe.

The realization of a second software problem explains why the timeline that Boeing projected publicly last week for getting hundreds of the aircraft airborne again has slipped...




So... What is that second flight software fault that was found? And in what way critical to flight? And how many passenger flights has that software been flying with what real risk??

Anyone able to sleuth further details?


All in our only one world,
Martin

---

See new freedom: Mageia Linux
Take a look for yourself: Linux Format
The Future is what We all make IT (GPLv3)