Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Lack of redundancies on Boeing 737 MAX baffles some involved in developing it

seattletimes.com

Post reply on HN
Print view View original

141–150 of 163 posts

Re: Lack of redundancies on Boeing 737 MAX baffles some involved in developing it

#141

Post by Cacti »

AceyMan wrote: post #127
ncallaway wrote: post #120

Earlier quoted context omitted.

One significant problem as I understand it was the assumption that a failing MCAS would present as runaway stabilizer trim. When, in actuality, it may not have looked much like runaway stabilizer trim to the pilots. My understanding is in a runaway stabilizer trim situation the trim wheel (a medium sized wheel near the pilot and co-pilots knees) spins continuously and makes a loud clacking noise as part of the spinni…

NB. It seems this moment news is breaking that the Ethiopia pilots indeed followed the checklist — yet they still lost the airplane. This is getting worse for Boeing at every turn.

Well, it sounds like they turned off the autopilot but then turned it back on, which is not part of the checklist. It’s not clear from the reporting exactly what happened and I would hesitate to jump to conclusions. Accidents like this are almost always hugely complicated and are the result of many things going wrong in a specific order at a specific time, rather than a single factor.

In fact we don’t even know what the cause of the crash was, and we won’t actually know for several months—there have been a number of crashes where everyone “knew” what the cause was early on, only for it later to come to light that is was something completely unrelated.

Re: Lack of redundancies on Boeing 737 MAX baffles some involved in developing it

#142

Post by DanieI »

js2 wrote: post #2

Despite the headline, the article ends with: That triple-sensor system isn’t foolproof, however. In 2008, on a customer-acceptance flight of an Airbus A320, two of the angle-of-attack sensors froze and those two sensors then outvoted the third. When the pilots went to demonstrate the stall-prevention system, they were not aware of the malfunctioning sensors. The plane crashed, killing the seven people on board. The s…

> Eight minutes after takeoff, two of the angle-of-attack sensors froze at the same pitch.

If it's typical for the sensor's data to vary from 30.00 to 30.99 degrees as the wind passes over the wings and two sensors are permanently frozen at 10.42, after 8 minutes I think that there might be a high enough probability for the computer's software to decide that two sensors are broken and one is working.

Re: Lack of redundancies on Boeing 737 MAX baffles some involved in developing it

#143

Post by linuxftw »

sixothree wrote: post #118
crocal wrote: post #61

I am a designer and implementor of vital speed and distance measurement systems, with triply modular redundancy, used in mass transit application. I cannot even imagine what the designers of this thing are going through now. It must be terrible. To make it worse, it's a confusing topic. There are two pillars to the design of such system. 1. Faulty sensor must be detected with a very high probability. The typical way…

Are AOA sensors really so prone to failure that they caused the downing of two airplanes?

I wouldn't think so. My personal theory is AoA is sending valid data to one of the flight computers, that flight computer is sending invalid data to the MCAS, or the MCAS has a software problem.

I suspect AoA is sending signed data, computer expects unsigned data, or possibly LSB/MSB conversion problem. Or it could just be faulty logic somewhere.

Re: Lack of redundancies on Boeing 737 MAX baffles some involved in developing it

#144

Post by linuxftw »

AceyMan wrote: post #126
bdonlan wrote: post #47

Earlier quoted context omitted.

The MCAS is designed to prevent an aerodynamic stall; a situation where the plane is pointed too far up and as a result starts heading straight for the ground. It does do by detecting the plane pointing too far up, and pushing it back down. If it did not function when the plane was descending rapidly it would not be fit for its designed purpose.

> The MCAS is designed to prevent an aerodynamic stall [...] This has become a trope and is flatly incorrect. MCAS was cooked up to maintain the handling characteristics required by the certification specifications. The standard requires stick resistance to increase as the critical (stall) angle of attack is approached. The MAX violated that requirement due to the aerodynamics of the new engine cowls, so MCAS was Boe…

There seem to be a handful of people spreading this talking point here. In every authoritative source, MCAS is described as anti-stall system.

Re: Lack of redundancies on Boeing 737 MAX baffles some involved in developing it

#145

Post by Cacti »

js2 wrote: post #2

Despite the headline, the article ends with: That triple-sensor system isn’t foolproof, however. In 2008, on a customer-acceptance flight of an Airbus A320, two of the angle-of-attack sensors froze and those two sensors then outvoted the third. When the pilots went to demonstrate the stall-prevention system, they were not aware of the malfunctioning sensors. The plane crashed, killing the seven people on board. The s…

a customer acceptance fight is a shitty way to go

Re: Lack of redundancies on Boeing 737 MAX baffles some involved in developing it

#146

Post by linuxftw »

havkom wrote: post #112

I have no idea of the facts in this case, but based on how organizations function in general, one possibility is that the redundancy issues of MCAS were raised internally by some engineers without result. In that case, the engineers were probably not thanked internally back then and are probably not thanked now either. If their potential concerns would had led to changes on the MCAS design they would probably not hav…

> MCAS were raised internally by some engineers

I think it's quite generous to Boeing to imply the MCAS system was developed in house. I'm leaning towards 3rd party contract, built to Boeing's spec. Whoever wrote the spec might be 3rd party as well, with Boeing's 'engineers' just performing as project managers.

Re: Lack of redundancies on Boeing 737 MAX baffles some involved in developing it

#147

Post by AceyMan »

linuxftw wrote: post #144
AceyMan wrote: post #126

Earlier quoted context omitted.

> The MCAS is designed to prevent an aerodynamic stall [...] This has become a trope and is flatly incorrect. MCAS was cooked up to maintain the handling characteristics required by the certification specifications. The standard requires stick resistance to increase as the critical (stall) angle of attack is approached. The MAX violated that requirement due to the aerodynamics of the new engine cowls, so MCAS was Boe…

There seem to be a handful of people spreading this talking point here. In every authoritative source, MCAS is described as anti-stall system.

I believe the critical passage is here in CFR 14 §25.175¹

(2) With the landing gear retracted at low speed, the stick force curve must have a stable slope at all speeds within a range which is the greater of 15 percent of the trim speed plus the resulting free return speed range, or 50 knots plus the resulting free return speed range, above and below the trim speed (except that the speed range need not include speeds less than 1.3 VSR1, nor speeds greater than the minimum speed of the applicable speed range prescribed in paragraph (b)(1), nor speeds that require a stick force of more than 50 pounds)[...]

The crucial phrase is "stick force curve", which is the characteristic MCAS was created to tweak.

As far as 'authoritative sources' go, I'll just mention the Gell-Mann amnesia effect.²

(me: non-active aircraft dispatcher)

¹—https://www.ecfr.gov/cgi-bin/text-idx?node=14:1.0.1.3.11#se1... ²—https://en.wikipedia.org/wiki/Gell-Mann_amnesia_effect?wprov...

Re: Lack of redundancies on Boeing 737 MAX baffles some involved in developing it

#148

Post by pytyper2 »

oldjokes wrote: post #98
crocal wrote: post #61

I am a designer and implementor of vital speed and distance measurement systems, with triply modular redundancy, used in mass transit application. I cannot even imagine what the designers of this thing are going through now. It must be terrible. To make it worse, it's a confusing topic. There are two pillars to the design of such system. 1. Faulty sensor must be detected with a very high probability. The typical way…

My car is only five years old but already has two sensors that have gone bad in the engine. Neither of them are vital and everything works great despite the occasional check engine light. Redundancy. It's a time intensive process to pop the head off and replace sensors. Nobody wants to pay their mechanic $100 an hour if they can avoid it. I can't even imagine a sensor failure having zero redundancy, much less changin…

"...everything works great despite the occasional check engine light..." that may make you feel better but it's not true. The life and efficiency of your engine is being reduced. What year, make, model are you driving? When you sell it do you plan on telling the next owner that you drove it religiously with the check engine light on?

Re: Lack of redundancies on Boeing 737 MAX baffles some involved in developing it

#149

Post by salawat »

linuxftw wrote: post #143
sixothree wrote: post #118

Earlier quoted context omitted.

Are AOA sensors really so prone to failure that they caused the downing of two airplanes?

I wouldn't think so. My personal theory is AoA is sending valid data to one of the flight computers, that flight computer is sending invalid data to the MCAS, or the MCAS has a software problem. I suspect AoA is sending signed data, computer expects unsigned data, or possibly LSB/MSB conversion problem. Or it could just be faulty logic somewhere.

The sensors on Lion Air were 10+ degrees out of calibratiom IIRC.

Critical AoA is somewhere in the realm of 17 to 20 degrees.

That doesn't leave much room for where MCAS wouldn't be a problem.

Also, AoA sensors are not normally safety critical. The MAX is the first 737 airframe for which this is the case.

Re: Lack of redundancies on Boeing 737 MAX baffles some involved in developing it

#150

Post by trhway »

nindalf wrote: post #76
crocal wrote: post #61

I am a designer and implementor of vital speed and distance measurement systems, with triply modular redundancy, used in mass transit application. I cannot even imagine what the designers of this thing are going through now. It must be terrible. To make it worse, it's a confusing topic. There are two pillars to the design of such system. 1. Faulty sensor must be detected with a very high probability. The typical way…

> even worse, not exported to the training material of the pilots According to this article ( https://www.vox.com/business-and-finance/2019/3/29/18281270/... ), this was a requirement of the 737-MAX while it was being developed. It needed to be sold as pretty much the same as it's predecessors, therefore requiring minimal retraining. > The training piece is important because a key selling feature of the 737 Max was t…

>at the cost of increasing the possibility of pilots not really knowing how to handle the planes

not excusing Boeing here, just extrapolating the situation to where there are so many automated systems doing so much and such complicated stuff that handover to pilot is just not an option (especially if plane is designed to fully utilize the automated systems capabilities). Like F-16 which just can't flown manually, or autonomous vehicles (Uber/Tesla/ect.) where handover to human driver in reality is absolutely not option. I mean, look how we completely lost the ability to stick-shift the cars.

Post reply on HN