Boeing MAX production cut signals long grounding • Hacker News Board

Re: Boeing MAX production cut signals long grounding

#61

Post by saryant » Sun, Apr 07, 2019, 7:34 PM UTC

jdsully wrote: post #54

tus87 wrote: post #10

Earlier quoted context omitted.

Then why are they slowing production? Interesting how the article doesn't explain that. > had a common link of a malfunctioning flight-control software called MCAS. My understanding is the software was fine, it was faulty sensors with no redundancy and poor feedback displays to pilots.

If the planes aren't allowed to fly, then they won't have any place to put them. Boeing Field is pretty small.

The FAA will grant special permits for flying grounded planes without passengers. This isn't that big of a problem.

Re: Boeing MAX production cut signals long grounding

#62

Post by msbarnett » Sun, Apr 07, 2019, 7:36 PM UTC

MuffinFlavored wrote: post #18

tibbydudeza wrote: post #9

Like the Toyota unintended acceleration issue we need third parties to look at the flight control software and engineering decisions taken for the MAX line and give a an independent report. Certainly not the FAA who delegated their oversight to Boeing. 346 people died because of their ineptitude.

> 346 people died because of their ineptitude. This might be too hot of a take for HackerNews, but... look at how many people the FAA has kept safe over the past 30 years. I'm pretty sure the number of people who travel without dying is very, very high. I don't disagree that their might have been some ineptitude (I'm sure you could find that anywhere for anything since it's opinion driven), but to say the FAA is all…

The FAA has not been an unchanaging entity operating under an unchanging set of rules for the past 30 years.

In reality, major changes have been made to the way that the FAA operates and delegates authority in a series of sweeping changes since 2005 that were largely meant to cover for the fact that Congress has been severely underfunding the FAA.

The MAX is one of the first models we’ve seen wholly designed and manufactured under this new process. (substantial amounts of the underlying safety analysis of the 787 happened under the old setup)

One major change that may be relevant in this case is that whereas Designated Engineering Representatives used to do safety analysis work at Airplane manufactures in a completely parallel, firewalled cross-cutting engineering group that effectively reported directly to the FAA in a quasi on-loan model, “in order to reduce costs” the FAA allowed this to be scrapped and replaced with “Airworthiness Representatives” embedded in, and crucially answering to, the regular engineering management at the company. Company management then acts as middle-man to the FAA. AR Management at say Boeing is nominally supposed to act as independent of Boeing and represent FAA opinions, but in practice routinely pushes back on FAA requests and acts to represent the interests of Boeing management: https://www.seattletimes.com/business/delegating-aircraft-sa...

So previously if day-to-day engineering was under pressure from a manager to ship a software subsystem or complete a component design, these deadlines were unrelated to the DERs, who operated in their own safety-focused management chain under the FAA.

Now, the AR is under the same manager and pressures as everyone else to hit the ship date. It is unsurprising that quality of analysis might take a back seat to job security in such a setup.

It does not make much sense to defend the FAA by pointing at successes produced by processes that were no longer in place by the time the 737 MAX engineering programme began.

Re: Boeing MAX production cut signals long grounding

#63

Post by diminoten » Sun, Apr 07, 2019, 7:42 PM UTC

lisper wrote: post #57

diminoten wrote: post #42

Earlier quoted context omitted.

All deaths can be traced back to some kind of profit motive, but I don't see you protesting every hospital/doctor on the planet. It's incredibly dangerous to propose changes to the FAA, given how much of an unqualified success they've had over the years at keeping flight safe. Don't let y our populist rage kill probably one of the best/most successful government institutions the US has ever created.

> It's incredibly dangerous to propose changes to the FAA That is an incredibly ironic thing to say, because these deaths are a result of changes to the FAA, specifically, the delegation of the FAA's regulatory authority to the company being regulated. That this would not end well was easily foreseeable because it's such a blatant conflict of interest.

Literally not true, but okay...

Re: Boeing MAX production cut signals long grounding

#64

Post by jayalpha » Sun, Apr 07, 2019, 7:45 PM UTC

jarym wrote: post #24

“This came so quickly and was steep” Somewhat poor choice by the writer here given the association.

ROTFL

Re: Boeing MAX production cut signals long grounding

#65

Post by Retric » Sun, Apr 07, 2019, 7:51 PM UTC

trimbo wrote: post #49

Retric wrote: post #11

Earlier quoted context omitted.

At best, stricter regulations may have resulted in a different design to comply with US regulations. The FAA is not a global organization, they don’t have oversight over any of the crashed aircraft. So, it’s tricky to place blame on US regulators for foreign crashes.

> The FAA is not a global organization, they don’t have oversight over any of the crashed aircraft. The FAA has bilateral agreements with other countries and the EU for certification[1]. I read recently but can't quickly find in this that the FAA trusts EASA's certs for Airbus flying in the US. The Ethiopian agency also trusts the FAA and EASA for this information[2] So, it's not really tricky here, we can blame the…

Edit: The entire point around these regulations is managing trust. Aircraft manufacturers are trying to build safe aircraft, the question is how much oversight is nessisary. EASA largely trusted the FAA and the FAA largely trusted Boing which they need to do. EASA can’t verify every bolt, they need to trust the manufacturer’s process to some degree.

So, EASA can’t really abandon blame as easily as they abandon responsibility. If they allow a flawed process to continue then that’s on them.

However, in this case these agreements still give EASA veto authority about what aircraft are allowed. Which is why EASA was able to ground these airplanes before the FAA did.

Re: Boeing MAX production cut signals long grounding

#66

Post by Svip » Sun, Apr 07, 2019, 7:53 PM UTC

wtvanhest wrote: post #28

MuffinFlavored wrote: post #18

Earlier quoted context omitted.

> 346 people died because of their ineptitude. This might be too hot of a take for HackerNews, but... look at how many people the FAA has kept safe over the past 30 years. I'm pretty sure the number of people who travel without dying is very, very high. I don't disagree that their might have been some ineptitude (I'm sure you could find that anywhere for anything since it's opinion driven), but to say the FAA is all…

Was this aircraft even under FAA jurisdiction? I thought the FAA only had jurisdiction over airline flights to and from the US.

Certifying aircraft is a long and expensive process. So generally speaking, aviation authorities 'share the burden' by relying on each other. By the same token, the FAA will take an EASA certification of an Airbus aircraft as valid without much additional checking.

FAA's reputation alone was good enough for other aviation authorities to accept its certification of Boeing's MAX 8, which is why the FAA matter despite happening way outside its jurisdiction.

Re: Boeing MAX production cut signals long grounding

#67

Post by Macha » Sun, Apr 07, 2019, 7:56 PM UTC

darkpuma wrote: post #48

maxmunzel wrote: post #43

Earlier quoted context omitted.

As far as i know you use three sensors, so you can automatically compensate for one failing/misreporting sensor without human intervention.

You can't compensate because you don't know which one is wrong. However you can make MCAS inactive whenever the two sensors are disagreeing with each other.

With the current two sensor setup, that is true.

This is why the parent poster is arguing for 3 sensors (and the real reason for tripling). If not all sensors agree but 2/3 do, it is more probable that the two sensors are correct than the 1 sensor disagreeing.

Re: Boeing MAX production cut signals long grounding

#68

Post by fmihaila » Sun, Apr 07, 2019, 7:57 PM UTC

4thaccount wrote: post #34

rasz wrote: post #16

Earlier quoted context omitted.

I agree, we need someone like Michael Barr to comb thru supposedly clean safety certified Ada codebase (in reality most likely full of C++ garbage).

Is there a percentage pie chart for what was used on the MAX? Like 80% Ada, 15% C++, and 5% C? I wonder if we'll see a move to things like Spark where proof verification becomes more standard? I don't know much about avionics software, so any educated comments are welcome.

> Is there a percentage pie chart for what was used on the MAX? Like 80% Ada, 15% C++, and 5% C? I wonder if we'll see a move to things like Spark where proof verification becomes more standard? I don't know much about avionics software, so any educated comments are welcome.

It's not about software verification. In this case, the verifier would have given it a pass (with respect to this particular accident).

It's about bad management/bad requirements:

- "minimization of pilot training is the overarching requirement"

- "it's okay to feed only a single sensor into MCAS, even though there are two of them on the plane"

- "it's okay to sell critical safety equipment as options costing extra"

- "it's okay to not tell any pilot about any of this, since we practically didn't change anything".

This particular one is not about C++.

Re: Boeing MAX production cut signals long grounding

#69

Post by salawat » Sun, Apr 07, 2019, 8:08 PM UTC

Putting on the Wild Ass Guess hat.

I remember reading that the MCAS system uses the exact same physical contacts as the pilot's electrical trim adjustment switches.

I'm wondering if they're trying to change their software implementation to more cleanly separate the two abstractions in the code in order to avoid having to do a hardware or firmware change on the jackscrew motor controllers.

If before, the signalling was such that the signalling was handled as a sort of one off block jammed into some function somewhere, they may now have to be doing much more thorough refactoring to separate out those interfaces, and improve the traceability, testability, and readability, all with the overhead of a system likely reclassified to "catastrophic" system hazard rating.

Either way, after some number crunching of my own, I can only see going forward with MCAS reasonable if there is some way to discretely disable its' ability to signal the jackscrew motor while leaving the electronic trim available in case of erroneous MCAS activation in the future, because with the requisite torque involved to quickly actuate that control surface against potential overspeed loads exacerbated by elevator up pitch commands, you'd need the electric motors, period.

Without taking into account friction, and using the stabilizer dimensions of the 737-800, in air conditions approximate to Addis Ababa, at 350 knots, discluding extra load from elevator up, and assuming an M24 jackscrew thread, it would have taken 357 ft-lbs torque to actuate against that wind load.

That's the output of a non-trivial automotive engine to bring that down to something the non-mathematically inclined can recognize, and while theoretically may be possible to gear for from a hand crank, I'm not confident I'm going to be able to figure out a gear train that can gear reduce enough to allow anywhere near enough speed when rotated by one pilot to get that horizontal stabilizer where it needs to be in so short a length of time.

Either way, I foresee a lot of chaos, and scrutiny moving forward in the handling of this, and can only hope we can finally come to terms as a nation with why certain regulatory agencies are worth the cost of investing in if only to keep the seeds of such tragedies as happened here from ever being able to germinate again.

Re: Boeing MAX production cut signals long grounding

#70

Post by Baeocystin » Sun, Apr 07, 2019, 8:11 PM UTC

TheSpiceIsLife wrote: post #50

thechao wrote: post #14

Earlier quoted context omitted.

Toyota never had an “unintended acceleration issue”—that was purely human error. A Toyota engine can’t overpower its brakes, unless there was gross negligence in the care of the brakes, i.e., they were totally inoperative. Just to make sure we’re clear on the braking thing: if you were to accelerate a Toyota sedan (any of them) to 70mph, then stomp on the brakes while holding the accelerator to the floor, the car wil…

if you were to accelerate a Toyota sedan (any of them) to 70mph, then stomp on the brakes while holding the accelerator to the floor, the car will absolutely come to a complete halt in about the same distance as if you didn’t have your foot on the accelerator. Are you saying the additional, let’s say, what?, 60kW of power being applied to the wheels will require no additional effort at the brake pedal to overcome. Co…

Assuming a properly-maintained braking system, it makes very little difference.

>And despite dramatic horsepower increases since C/D’s 1987 unintended-acceleration test of an Audi 5000, brakes by and large can still overpower and rein in an engine roaring under full throttle. With the Camry’s throttle pinned while going 70 mph, the brakes easily overcame all 268 horsepower straining against them and stopped the car in 190 feet—that’s a foot shorter than the performance of a Ford Taurus without any gas-pedal problems and just 16 feet longer than with the Camry’s throttle closed.

From https://www.caranddriver.com/features/a16576573/how-to-deal-...