MCAS: How 737 MAX system gained power and lost safeguards
seattletimes.com
MCAS: How 737 MAX system gained power and lost safeguards
1–10 of 42 posts
Re: MCAS: How 737 MAX system gained power and lost safeguards
#2Previous Seattle Times article about the certification of the 737MAX: https://www.seattletimes.com/business/boeing-aerospace/faile...
And HN post: https://news.ycombinator.com/item?id=19421612
Re: MCAS: How 737 MAX system gained power and lost safeguards
#3The thinking of "we don't want the system to not work if it's needed" thinking demonstrates a failure to understand the prior probabilities involved.
Most of the time the flight conditions will not warrant activation of the MCAS, and apparently the system is sufficiently unreliable/easy to damage that the chances of the system inadvertently triggering is high. But Boeing wanted to be sure that MCAS would always activate if needed, even if that resulted in unintended activations normally.
Boeing essentially optimized around a low probability of a false negative, while ignoring the high probability of a false positive, because they underestimated the consequences and confusion that would result from a false positive - in many cases, multiple alarms/system failures occurring simultaneously as other systems that rely on that sensor begin alarming as well. In that environment, designing around a 3 second response time (on a system that pilots weren't trained to know exists) is probably unreasonable.
Re: MCAS: How 737 MAX system gained power and lost safeguards
#4The thinking of "we don't want the system to not work if it's needed" thinking demonstrates a failure to understand the prior probabilities involved. Most of the time the flight conditions will not warrant activation of the MCAS, and apparently the system is sufficiently unreliable/easy to damage that the chances of the system inadvertently triggering is high. But Boeing wanted to be sure that MCAS would always activ…
Well, Boeing is multiple people. Business culture celebrates a manager who can push their project ahead of others. Maybe MCAS had a project manager who was a bit of an overachiever in that regard.
Re: MCAS: How 737 MAX system gained power and lost safeguards
#5So my understanding following this:
* they designed mcas with a g sensor and aoa sensor and a max pitch, to fix a problem in a high speed test. They provide safety assessments based on having two sensors, limited pitch changes, and it only triggering in specific rare situations.
* they provided that to the FAA as justification no training was needed, and that there was no need to acknowledge the existence of the system. FAA agreed.
* After FAA approval they discovered that the aircraft didn’t work correctly at low speed either, so they made it activate at low speed as well. Because it activated at low speed a g sensor wasn’t possible (?) so it got removed. Now you only have a single (notoriously unreliable) AoA sensor controlling it. To compensate for poor aero they also needed to increase the amount of pitch needed. So the FAA approved MCAS with a 0.6 degree pitch limit, occurring at high speed, triggered by two independent sensors. Boeing then made the system trigger at low speed, off a single sensor, and increase pitch adjustment to 2.6 degrees.
* Boeing chose not to test what happened if the AoA sensor failed.
* Boeing continued to insist that pilots not be made to retrain, because of contract penalties with southwest. That meant they did not want to mention the existence of the system.
* there safety margins also included an assumption that pilots could respond to a problem in 3s. But when mcas triggered incorrectly they were given speed, stall, and altitude warnings. All of which distracted them from the non-functioning led that indicate activation of a system that Boeing did not tell the pilots existed.
* the standard way to recover from the flight control computer triggering to much pitch was to flip a switch on the stick. Boeing made MCAS override that command, so the standard recovery could not work.
* Boeing continued to claim the plane was airworthy and provided a work around for its hellbent desired to crash, which was to use the manual pitch wheel. Except MCAS was designed in such a way that as part of its crash into the ground logic it put so much stress on the system that it was not physically possible for a pilot to perform the workaround.
In all: more than 300 people are dead because Boeing rushed to make a plane to compete with another company, and then hid information about an overriding control system so that they wouldn’t have to retrain pilots, and that completely changed the parameters of that system after FAA approval such that none of their approved safety claims were remotely true.
All to make some money so executives could get their bonuses.
Every executive who pushed for those changes should be put in jail.
Re: MCAS: How 737 MAX system gained power and lost safeguards
#6So my understanding following this: * they designed mcas with a g sensor and aoa sensor and a max pitch, to fix a problem in a high speed test. They provide safety assessments based on having two sensors, limited pitch changes, and it only triggering in specific rare situations. * they provided that to the FAA as justification no training was needed, and that there was no need to acknowledge the existence of the syst…
And, Boeing's justification for increasing MCAS capabilities while reducing sensor redundancy needed was that these were changes in degree, not in kind. Nothing about the FAA certification actually depended on the number of sensors required, or the amount of command the system had, the FAA allowed pretty much anything to fly as long as it was only designed to operate when outside of the standard flight envelope.
This is the gotcha in the whole liability for executives thing. The FAA is extremely deferential to what manufacturers think is the best practice. Understandably it would be difficult to get every single little change to the flight systems approved - in broad strokes this kind of regulatory inertia is what makes physical changes so difficult in the first place, which indirectly caused this whole problem in the first place.
This isn't just a Boeing problem - Boeing was callous and indifferent to public safety, but the FAA let them get away with it. The takeaway from this crisis is that the FAA regulatory system needs significant reform, because it's obvious that it's got some unintended consequences. The correct answer here is that it should have been viable to design the airplane in an inherently aerodynamically safe fashion while the band-aid patch should have received a huge degree of scrutiny, but that's essentially the opposite of the system that the FAA has created.
Re: MCAS: How 737 MAX system gained power and lost safeguards
#7So my understanding following this: * they designed mcas with a g sensor and aoa sensor and a max pitch, to fix a problem in a high speed test. They provide safety assessments based on having two sensors, limited pitch changes, and it only triggering in specific rare situations. * they provided that to the FAA as justification no training was needed, and that there was no need to acknowledge the existence of the syst…
> the standard way to recover from the flight control computer triggering to much pitch was to flip a switch on the stick. Boeing made MCAS override that command, so the standard recovery could not work.
My understanding of this part was different. The standard way to recover is a pair of switches in the central part of the panel (not in the stick), which cuts off all power to the trim motors; these switches still work (though they work in slightly a different way than previous models). What MCAS overrides is a pair of sensors in the stick, which detect when the stick is being moved in the direction opposite to the electric trim, and in that case temporarily disable the trim motors; since MCAS by design moves the electric trim in the opposite direction that the pilot is moving the stick, it has to override these sensors, otherwise it couldn't do its job.
Re: MCAS: How 737 MAX system gained power and lost safeguards
#8All of this to help avoid stalls. Such a pity because avoiding a stall seems to be one of the first things a new pilot learns. Every pilot should know how to detect and correct a stall.
Can an actual pilot conform or deny this?
Re: MCAS: How 737 MAX system gained power and lost safeguards
#9All of this to help avoid stalls. Such a pity because avoiding a stall seems to be one of the first things a new pilot learns. Every pilot should know how to detect and correct a stall. Can an actual pilot conform or deny this?
It was less about avoiding stalls and more about making sure the performance characteristics of the MAX were similar enough to the previous generations of 737s so that a new type rating wasn't required for the pilots which would have required expensive training.
Re: MCAS: How 737 MAX system gained power and lost safeguards
#10Retrospective ass covering, Boeing installed MCAS to save money, and in the process took control of the airplane away from the pilots. They should be looking at jailtime for this.