Boeing Built Deadly Assumptions into 737 Max, Blind to a Late Design Change • Hacker News Board

Re: Boeing Built Deadly Assumptions into 737 Max, Blind to a Late Design Change

#251

Post by mikeash » Sun, Jun 02, 2019, 4:17 PM UTC

droithomme wrote: post #232

mikeash wrote: post #4

Earlier quoted context omitted.

The problem isn’t failure, but detecting failure. If the sensor had just stopped responding, there wouldn’t have been any problem. The planes would keep flying, the sensors would get replaced, and everyone would be fine. What happened was that the sensor gave erroneous readings. The MCAS system reacted to those erroneous reading and crashes the plane. With two sensors, you can detect failure. It’s very unlikely that…

> It’s very unlikely that both would fail simultaneously. Ice, insects, birds, and volcanic ash are all things that tend to cause the pitot and the static tubes to become blocked. When you encounter ice, insects, birds, and volcanic ash, it is often the case that you get multiple simultaneous blockages. Blockages of the various tubes are not statistically independent events in practice.

Pitot and static tubes are irrelevant here.

Would it trouble everyone to get a basic grasp of what we’re talking about before replying? I’m getting a little tired of constantly correcting basic stuff in the replies.

Re: Boeing Built Deadly Assumptions into 737 Max, Blind to a Late Design Change

#252

Post by darkpuma » Sun, Jun 02, 2019, 5:02 PM UTC

phkahler wrote: post #233

volkl48 wrote: post #59

Earlier quoted context omitted.

Doesn't handle well is not equivalent to "is uncontrollable", though.

If I recall, it made it more prone to stall in certain conditions. I'd like to call that hazardous, but without test pilot feedback I'm not sure how to classify it. My recollection from articles a few months ago is that they added MCAS not due to simple differences in handling, but due to a potentially hazardous difference in handling.

Mentour Pilot on youtube, a 737 instructor, has a few videos about it. The gist is that in any plane when you're close to stall, you want to pitch down and increase airspeed over the wings. Depending on the precise circumstances you do this by pitching down and throttling up. However in the case of every 737 and in fact any aircraft with engines slung below the wings, the act of throttling up the engines causes the airplane to pitch up. The reason is because the engines are not in line with the center of mass. Imagine rowing a row boat with only a single oar.

This is something all 737 pilots are trained for, so they have to balance that pitch up from the engines throttling up by pitching the plane down more than they would otherwise need to. The precise relationship between throttling up and pitching up was changed when the 737 was modified to create the 737 MAX. Namely, on the 737 MAX the pitch-up is more extreme. It is not so extreme that it makes the airplane a bad design, but it is extreme enough that pilots need to not expect the legacy 737 behavior.

Had pilots been trained for the performance characteristics of the 737 MAX specifically, it would have been perfectly fine. But they weren't, and instead MCAS was meant to paper over the difference so pilots could be kept in the dark (which is cheaper but borderline homicidal...)

To put this another way, in some hypothetical universe where the 737 MAX was the first 737 ever, it would have been introduced without MCAS and pilots would have said it handles like a dream. Then, when the 737 NG was introduced after the 737 MAX, there might have been a reverse-MCAS system implemented to make the NG handle like a MAX. That reverse-MCAS system may have then failed catastrophically.

Re: Boeing Built Deadly Assumptions into 737 Max, Blind to a Late Design Change

#253

Post by frostburg » Sun, Jun 02, 2019, 5:10 PM UTC

perl4ever wrote: post #239

frostburg wrote: post #183

Earlier quoted context omitted.

That's some pretty impressive ingrained bias towards rent-seekers. Why not 1.1x or the board can try doing the work?

Consider a fast food business. Should the manager be satisfied with making 10% profit on french fries?

10% on raw materials would be losing money, but 10% on total expense, with the difference going to the workforce is fine to me. I don't see why fast foods shouldn't be cooperatives, they're not exactly capital intensive or high risk.

To be clear, I wasn't referring to the board having a choice in the matter.

Re: Boeing Built Deadly Assumptions into 737 Max, Blind to a Late Design Change

#254

Post by Xixi » Sun, Jun 02, 2019, 6:04 PM UTC

mikeash wrote: post #127

inferiorhuman wrote: post #96

Earlier quoted context omitted.

There’s a big difference between a system which must work and a system which must not go wrong. For example, the fly by wire system in an Airbus must work. A failed sensor must not disable the system. Thus, you need at least triple redundancy to keep functioning in the event of a failure. Fly-by-wire Boeings still only have two alpha vanes. Go ahead, take a look at the next 777 or 787 you come across.

Presumably the AoA sensors are not required for that system to function.

AoA sensors are not required for Airbus FBW systems to function either. But they are required for the flight enveloppe protection system to function.

Re: Boeing Built Deadly Assumptions into 737 Max, Blind to a Late Design Change

#255

Post by holler » Sun, Jun 02, 2019, 6:21 PM UTC

danols wrote: post #85

The day someone very high up the corporate ladder truly gets held responsible for this type of greed & negligence and will be put a way for a long prison sentence would be a good day for society. But I am not holding my breath... But I hope that the CEO Dennis Muilenburg deep down understands he seriously fuxxed up real bad and every now and then is having a hard time falling a sleep in his $10M mansion knowing that…

His response to the question of "should you step down?" was "no, absolutely not, people's lives depend on me leading this company." No one is that important, and 346 people died unnecessarily on his watch from negligent business processes. He should be forced out.

Re: Boeing Built Deadly Assumptions into 737 Max, Blind to a Late Design Change

#256

Post by [deleted] » Sun, Jun 02, 2019, 6:23 PM UTC

01100011 wrote: post #176

danols wrote: post #85

The day someone very high up the corporate ladder truly gets held responsible for this type of greed & negligence and will be put a way for a long prison sentence would be a good day for society. But I am not holding my breath... But I hope that the CEO Dennis Muilenburg deep down understands he seriously fuxxed up real bad and every now and then is having a hard time falling a sleep in his $10M mansion knowing that…

Your comment makes it sound like you believe there was a single person with nefarious intentions or criminal negligence who chose to put lives at stake in exchange for profits. That is almost certainly not what happened. It is more likely a system of procedures and policies which failed. The company should take the hit, but unless an investigation reveals otherwise, I see no reason a single individual should take the…

[deleted]

Re: Boeing Built Deadly Assumptions into 737 Max, Blind to a Late Design Change

#257

Post by alexis_fr » Sun, Jun 02, 2019, 6:28 PM UTC

frostburg wrote: post #183

deanCommie wrote: post #162

Earlier quoted context omitted.

I assume these must be small examples on a long list of accomplishments, because 30k/year doesn't seem like it's enough to offset your salary. I have to imagine the impact of a principal engineer should be measured in the 10-100x of their salary?

That's some pretty impressive ingrained bias towards rent-seekers. Why not 1.1x or the board can try doing the work?

Sorry I both agree with you but reckon 10x is about the correct ratio. It’s not rent-seeking, it’s “sharing wealth” and “diminishing inequalities”. A good engineer needs to pay for: - Administrative employees, - Office rental, - Junior members of the teams who are growing up towards seniority, - Women who are non productive but required to pass the diversity requirements and make the company look good.

You may claim it’s unfair that productive members are exploited to pay for nonproductive ones, but that’s the neo-conservatives’ argument, and has been rejected by most of the Silicon Valley. I honestly think that the currebt situation is already the middle ground betweeb “pay proportional to your added value” and “diversity, equality and social responsibility requires adjusting the salaries of highest-paid engineers.”

Re: Boeing Built Deadly Assumptions into 737 Max, Blind to a Late Design Change

#258

Post by konspence » Sun, Jun 02, 2019, 7:27 PM UTC

CydeWeys wrote: post #18

aivisol wrote: post #15

Earlier quoted context omitted.

Ok, that makes sense. But are the hours at which they got replaced are on order (or several) of magnitude lower than a two-sensor failure can occur? I hope it is calculated.

The point is that, as safety-critical equipment, you can't fly the plane if one is broken. So you'd need to have two fail within a single flight, and fail in the same way, in order to cause an incorrect activation of MCAS. With just one sensor, it's much more likely. Note that Airbus uses three of these sensors on their planes, so that when one fails you know which one it is, and can still rely on the signals from th…

This works until two sensors fail in the same direction:

>The aircraft's computers received conflicting information from the three angle of attack sensors. The aircraft computer system’s programming logic had been designed to reject one sensor value if it deviated significantly from the other two sensor values. In this specific case, this programming logic led to the rejection of the correct value from the one operative angle of attack sensor, and to the acceptance of the two consistent, but wrong, values from the two inoperative angle of attack sensors. This resulted in the system's stall protection functions responding incorrectly to the stall, making the situation worse, instead of better.

https://en.m.wikipedia.org/wiki/XL_Airways_Germany_Flight_88...

Re: Boeing Built Deadly Assumptions into 737 Max, Blind to a Late Design Change

#259

Post by Ntrails » Sun, Jun 02, 2019, 8:03 PM UTC

CydeWeys wrote: post #235

sorisos wrote: post #203

Earlier quoted context omitted.

Perhaps related crash[0] where the autopilot was disabled because it was listening to user input, in this case a child. [0] https://en.wikipedia.org/wiki/Aeroflot_Flight_593#Accident

Oooof. Well the real lesson there is that unqualified people (especially children) shouldn't be in the cockpit of an airliner at all. Autopilot can't be made smart enough to determine if the person operating the controls actually knows what they're doing, and thus to follow/ignore them as appropriate.

I mean, pick your poison. Either the humans are more reliable or the computers are. Either way is subject to some level of fallibility.

Re: Boeing Built Deadly Assumptions into 737 Max, Blind to a Late Design Change

#260

Post by cmurf » Sun, Jun 02, 2019, 8:52 PM UTC

TheOtherHobbes wrote: post #186

cmurf wrote: post #114

Earlier quoted context omitted.

Citation needed. FAR 25 applies to all transport category aircraft. The section on stability (§§ 25.171 - 25.181). In exactly what manner is the airplane not stable, with or without MCAS?

It's not stable in a "crashes into the ground and kills everyone on board in spite of the best efforts of its pilots" manner. In exactly what manner is it not obvious this is not an acceptable design outcome?

You are confusing stability, which is a specific aerodynamic term, with two examples of catastrophic outcomes. Reread the original post I replied to, none of the first three sentences are true: unstable flight characteristics, instability is a hardware problem, software routine only exists to paper over the hardware problem.

The problem results from an edge case or it would be happening a lot more often. That it's an edge case doesn't mean it isn't serious or shouldn't be fixed or that it's not a design flaw. But it is not a stability problem, it's the wrong word to use.

It misdirects the conversation from where it should be. The airplane aerodymics are the distraction. The central problem is when perturbed, this feature becomes a saboteur, 2.5 degrees of deflection in 10 seconds is asinine at Vmo. A human pilot acting on all the same information the flight computer has available, would be considered a maniac to correct for a clearly bogus angle of attack value with 40 degrees of nose down. It's that insane. And Boeing knew about the possibility, classified it as hazardous, and yet somehow no further exploration of what would happen upon arrival at such a hazardous event (MCAS upset) by any team at Boeing or 3rd parties or the FAA. It's mindboggling.

Meanwhile some people prefer distractions from those issues by using the wrong terms: it was designed badly, and the whole plane should be scrapped. With the above systemic problems at Boeing and FAA, who knows what kind of airplane they'd design to replace it and what sorts of problems it would or could have.

The whole impetus of the 737 MAX was a race against time to compete. If they had faced a much longer time frame for a whole new model, the pressure to cut corners is even higher. The opportunities to make mistakes are even higher.