Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

MCAS: How 737 MAX system gained power and lost safeguards

seattletimes.com

Post reply on HN
Print view View original

21–30 of 42 posts

Re: MCAS: How 737 MAX system gained power and lost safeguards

#21

Post by mantap »

paulmd wrote: post #3

The thinking of "we don't want the system to not work if it's needed" thinking demonstrates a failure to understand the prior probabilities involved. Most of the time the flight conditions will not warrant activation of the MCAS, and apparently the system is sufficiently unreliable/easy to damage that the chances of the system inadvertently triggering is high. But Boeing wanted to be sure that MCAS would always activ…

If it were designed correctly, it shouldn't matter if it were activated or not - it would always be safe. If it were designed correctly there would be at least 3 AoA sensors and the loss or disagreement of one would not affect the functioning of the system other than displaying a warning message to the pilots. If the two remaining disagreed then the system would be disabled.

This is assuming that the system is necessary for certification or safety, if it is not necessary for certification or safety then it shouldn't be there at all.

The fact that Boeing put a secondary autopilot in there with a single point of failure, can only be explained by organisational failures reminiscent of the Challenger disaster.

Re: MCAS: How 737 MAX system gained power and lost safeguards

#22

Post by the_pwner224 »

fwip wrote: post #16
runciblespoon wrote: post #10

Retrospective ass covering, Boeing installed MCAS to save money, and in the process took control of the airplane away from the pilots. They should be looking at jailtime for this.

Boeing still gives the pilots a lot of control over the airplane, compared to Airbus. Airbus has defaulted to fly-by-wire (i.e: the computer has control and the pilot makes suggestions) for planes made since the 1980's.

Airbus doesn't try to hide that fact from its pilots.

Re: MCAS: How 737 MAX system gained power and lost safeguards

#23

Post by salawat »

mantap wrote: post #21
paulmd wrote: post #3

The thinking of "we don't want the system to not work if it's needed" thinking demonstrates a failure to understand the prior probabilities involved. Most of the time the flight conditions will not warrant activation of the MCAS, and apparently the system is sufficiently unreliable/easy to damage that the chances of the system inadvertently triggering is high. But Boeing wanted to be sure that MCAS would always activ…

If it were designed correctly, it shouldn't matter if it were activated or not - it would always be safe. If it were designed correctly there would be at least 3 AoA sensors and the loss or disagreement of one would not affect the functioning of the system other than displaying a warning message to the pilots. If the two remaining disagreed then the system would be disabled. This is assuming that the system is necess…

The airframe cannot be certified airworthy without MCAS according to existing regulations. It is quite literally the only thing enabling the airframe to pass basic design requirements that have been mandated for years.

Re: MCAS: How 737 MAX system gained power and lost safeguards

#24

Post by Bendingo »

olliej wrote: post #5

So my understanding following this: * they designed mcas with a g sensor and aoa sensor and a max pitch, to fix a problem in a high speed test. They provide safety assessments based on having two sensors, limited pitch changes, and it only triggering in specific rare situations. * they provided that to the FAA as justification no training was needed, and that there was no need to acknowledge the existence of the syst…

Great summary.

Re: MCAS: How 737 MAX system gained power and lost safeguards

#25

Post by konspence »

mantap wrote: post #21
paulmd wrote: post #3

The thinking of "we don't want the system to not work if it's needed" thinking demonstrates a failure to understand the prior probabilities involved. Most of the time the flight conditions will not warrant activation of the MCAS, and apparently the system is sufficiently unreliable/easy to damage that the chances of the system inadvertently triggering is high. But Boeing wanted to be sure that MCAS would always activ…

If it were designed correctly, it shouldn't matter if it were activated or not - it would always be safe. If it were designed correctly there would be at least 3 AoA sensors and the loss or disagreement of one would not affect the functioning of the system other than displaying a warning message to the pilots. If the two remaining disagreed then the system would be disabled. This is assuming that the system is necess…

>If the two remaining disagreed then the system would be disabled.

On Lufthansa 1829, two of the three AOA sensors on an A321 erroneously agreed, causing a system similar to MCAS to kick in[1]

The sensors can also be damaged by birds

It seems like two sensors is not enough; nor are three. I'm curious whether it would be reasonable and feasible to add five to an aircraft

[1] Third bullet point under the A321 heading: https://en.wikipedia.org/wiki/List_of_accidents_and_incident...

Re: MCAS: How 737 MAX system gained power and lost safeguards

#26

Post by dboreham »

supportlocal4h wrote: post #17
paulmd wrote: post #6

Earlier quoted context omitted.

And, Boeing's justification for increasing MCAS capabilities while reducing sensor redundancy needed was that these were changes in degree , not in kind. Nothing about the FAA certification actually depended on the number of sensors required, or the amount of command the system had, the FAA allowed pretty much anything to fly as long as it was only designed to operate when outside of the standard flight envelope. Thi…

Wouldn't it be interesting if FFA signoff included approval by a regulatory team from the competing manufacturer. I wonder what abuses would crop up there.

Almost as if Google were to spent time and effort looking for security bugs in Microsoft products..

Re: MCAS: How 737 MAX system gained power and lost safeguards

#27

Post by xtof »

salawat wrote: post #23
mantap wrote: post #21

Earlier quoted context omitted.

If it were designed correctly, it shouldn't matter if it were activated or not - it would always be safe. If it were designed correctly there would be at least 3 AoA sensors and the loss or disagreement of one would not affect the functioning of the system other than displaying a warning message to the pilots. If the two remaining disagreed then the system would be disabled. This is assuming that the system is necess…

The airframe cannot be certified airworthy without MCAS according to existing regulations. It is quite literally the only thing enabling the airframe to pass basic design requirements that have been mandated for years.

Citation? Nothing in FAR 25 permits a computer system to make airworthy an unairworthy airplane design.

Re: MCAS: How 737 MAX system gained power and lost safeguards

#28

Post by ummonk »

olliej wrote: post #5

So my understanding following this: * they designed mcas with a g sensor and aoa sensor and a max pitch, to fix a problem in a high speed test. They provide safety assessments based on having two sensors, limited pitch changes, and it only triggering in specific rare situations. * they provided that to the FAA as justification no training was needed, and that there was no need to acknowledge the existence of the syst…

The pitch adjustment wasn't actually up to 2.5 degrees. It was 2.5 degrees each time MCAS was activated. After two cycles it can reach maximum nose down trim of 4.7 degrees. (Or after 8 cycles under the original 0.6 degrees pitch limit).

The Boeing safety analysis did not seem to have realized this was a possibility.

Re: MCAS: How 737 MAX system gained power and lost safeguards

#29

Post by toast0 »

olliej wrote: post #5

So my understanding following this: * they designed mcas with a g sensor and aoa sensor and a max pitch, to fix a problem in a high speed test. They provide safety assessments based on having two sensors, limited pitch changes, and it only triggering in specific rare situations. * they provided that to the FAA as justification no training was needed, and that there was no need to acknowledge the existence of the syst…

> there safety margins also included an assumption that pilots could respond to a problem in 3s. But when mcas triggered incorrectly they were given speed, stall, and altitude warnings. All of which distracted them from the non-functioning led that indicate activation of a system that Boeing did not tell the pilots existed.

There was never an indicator that MCAS activated, what Boeing has said was missing was an indicator (text on screen) for Angle of Attack disagree -- this would have been in addition to the airspeed disagree warning that was present, since airspeed for the 737 MAX is calculated based on pitot tube and angle of attack measurements.

This indicator was missing unless the aircraft was purchased with the option to show angle of attack. It's not clear if knowing that the sensors differ without being able to see the readings is very useful. Even being able to see the readings and determine one sensor is broken doesn't help a whole lot without training on MCAS to know what a broken sensor could trigger, and how to handle that.

Re: MCAS: How 737 MAX system gained power and lost safeguards

#30

Post by joshanderson »

mantap wrote: post #21
paulmd wrote: post #3

The thinking of "we don't want the system to not work if it's needed" thinking demonstrates a failure to understand the prior probabilities involved. Most of the time the flight conditions will not warrant activation of the MCAS, and apparently the system is sufficiently unreliable/easy to damage that the chances of the system inadvertently triggering is high. But Boeing wanted to be sure that MCAS would always activ…

If it were designed correctly, it shouldn't matter if it were activated or not - it would always be safe. If it were designed correctly there would be at least 3 AoA sensors and the loss or disagreement of one would not affect the functioning of the system other than displaying a warning message to the pilots. If the two remaining disagreed then the system would be disabled. This is assuming that the system is necess…

If the MAX was designed correctly then MCAS would not be needed in the first place.

Fixing MCAS is fixing the wrong problem.

Post reply on HN