Boeing Built Deadly Assumptions into 737 Max, Blind to a Late Design Change • Hacker News Board

Re: Boeing Built Deadly Assumptions into 737 Max, Blind to a Late Design Change

#261

Post by tachi_coma » Sun, Jun 02, 2019, 9:00 PM UTC

jacobush wrote: post #196

sirsuki wrote: post #190

Earlier quoted context omitted.

If the pilots were putting that much force on the yoke it is pretty apparent that the pilots really truly wanted the plan to do what they asked of it. I am curious what scenarios the designers of the plan drove then to not trust that the human in the seat really has no idea what they are doing. Was the ignoring the wishes of the pilot and attempt to prevent a crazed irresponsible and unlicensed idiot from doing somet…

You make it sound like the plane has some kind of agency. Though a plane is very complicated, the treacherous MCAS system is actually very simple.

I'm looking at the graph and imagining the MCAS with a bubbling, gleeful voice, not unlike that of a Tachikoma discovering something new. [0]

  Oh boy! A game! I love games!

Like a dog with a tennis ball in its mouth, thinking the game is tug-o-war and not fetch.

[0] https://www.youtube.com/watch?v=lNY53tZ2geg

During the final nose down, I can hear the Tachikoma triumphantly cheer, "I WIN!"

Re: Boeing Built Deadly Assumptions into 737 Max, Blind to a Late Design Change

#262

Post by cameldrv » Mon, Jun 03, 2019, 4:27 AM UTC

CydeWeys wrote: post #82

cameldrv wrote: post #51

Earlier quoted context omitted.

I haven't heard of it ever activating except in the incident/accident flights. It's required for certification, but you would either have to be mishandling the plane or get in some extreme weather for MCAS to activate. Think about it like the Antilock brakes on your car. Suppose the wheel position sensor fails. It's fine if the car puts up a warning light and says that you don't have antilock brakes anymore. You can…

ABS isn't the best example because it does prevent lots of accidents in its own right, including a >50% prevention rate of some types of accidents in rainy, snowy, or icy weather. The overall fatal accident reduction is 15% for cars and 27% for trucks and light trucks. Source: https://crashstats.nhtsa.dot.gov/Api/Public/ViewPublication/... And, anecdotally, I've had ABS kick in in some occurrences for which I was ver…

Having a safety system that rarely fails to prevent an accident is much different statistically than a safety system that rarely causes an accident.

Suppose the crash probability on a normal flight is 1/1E7, but without MCAS it's 100x more dangerous, or 1/1E5. Suppose MCAS failure probability is 1/1E6, the probability of an additional crash due to the failure of MCAS is 1/1E11, which is acceptable.

The problem is that in practice, the crash probability if MCAS fails is empirically 2/3 instead of 1/1E5, because MCAS actually causes the crash rather than merely failing to prevent a crash.

Re: Boeing Built Deadly Assumptions into 737 Max, Blind to a Late Design Change

#263

Post by jplayer01 » Mon, Jun 03, 2019, 5:29 AM UTC

bumby wrote: post #77

jaggirs wrote: post #64

Earlier quoted context omitted.

If the pilots had recieved training, then they could be a backup. So probably whoever did that safety analysis was assuming pilots would know how and when to turn off the system, but the pilots in fact didn't know this system existed at all.

Administrative mitigation like pilots are usually the least preferential ways of mitigating hazards. Humans are often the least consistent, most fallible part of a system. If there were engineering solutions available I would hope Boeing would implement them.

There are many examples of automated systems not accounting for novel or rare situations that the original designers didn't plan for or ignored. This is why manual override should always be available as a last resort if possible. No automated system we can design today is perfect. While protections and automatic mitigation should be implemented, taking away agency from pilots or whoever else is a recipe for disaster.

Re: Boeing Built Deadly Assumptions into 737 Max, Blind to a Late Design Change

#264

Post by brokenmachine » Mon, Jun 03, 2019, 5:33 AM UTC

sorisos wrote: post #203

sirsuki wrote: post #190

Earlier quoted context omitted.

If the pilots were putting that much force on the yoke it is pretty apparent that the pilots really truly wanted the plan to do what they asked of it. I am curious what scenarios the designers of the plan drove then to not trust that the human in the seat really has no idea what they are doing. Was the ignoring the wishes of the pilot and attempt to prevent a crazed irresponsible and unlicensed idiot from doing somet…

Perhaps related crash[0] where the autopilot was disabled because it was listening to user input, in this case a child. [0] https://en.wikipedia.org/wiki/Aeroflot_Flight_593#Accident

That was because the pilots were not aware that the autopilot had been disabled.

Pulling on the yoke 26 times, as hard as you possibly can, is a bit different.

Re: Boeing Built Deadly Assumptions into 737 Max, Blind to a Late Design Change

#265

Post by jmkni » Mon, Jun 03, 2019, 12:13 PM UTC

EdwardDiego wrote: post #225

zenzen wrote: post #165

Earlier quoted context omitted.

I had forgotten about the rudder problems! Worth a read: https://imgur.com/a/5wcFx8M > Perhaps the single most complex, insidious, and long-lasting mechanical problem in the history of commercial aviation was the mysterious rudder issue that plagued the Boeing 737 throughout the 1990s. Although it had long been rumoured to exist, the defect was suddenly thrust into the spotlight when United Airlines flight 585 crashe…

For anyone who enjoyed the write up, it's from reddit user AdmiralCloudberg who has a bunch of them, and they're all good: https://www.reddit.com/r/AdmiralCloudberg/comments/a4ckhv/pl...

Those images are blocked for me at work, would have been helpful if they had added the text itself to the Reddit posts!

Re: Boeing Built Deadly Assumptions into 737 Max, Blind to a Late Design Change

#266

Post by chipsa » Mon, Jun 03, 2019, 12:55 PM UTC

darkpuma wrote: post #252

phkahler wrote: post #233

Earlier quoted context omitted.

If I recall, it made it more prone to stall in certain conditions. I'd like to call that hazardous, but without test pilot feedback I'm not sure how to classify it. My recollection from articles a few months ago is that they added MCAS not due to simple differences in handling, but due to a potentially hazardous difference in handling.

Mentour Pilot on youtube, a 737 instructor, has a few videos about it. The gist is that in any plane when you're close to stall, you want to pitch down and increase airspeed over the wings. Depending on the precise circumstances you do this by pitching down and throttling up. However in the case of every 737 and in fact any aircraft with engines slung below the wings, the act of throttling up the engines causes the a…

MCAS was not designed to make the 737 Max behave like the 737 NG or Classic. It was designed to make the 737 Max certifiable at all.

The problem with the 737 Max is that the engine nacelles are further forward and larger than previously, so the lift that the nacelles make at high angle of attack is greater. This results in less stick force being necessary to maintain a high angle of attack than at lower angles of attack. This is uncertifiable behavior. Hence, MCAS, to augment the manuvering characteristics of the 737, to increase stick forces at high angles of attack.

In a hypothetical universe where the Max was the first 737, it'd be fly by wire and all the stick forces would be synthetically generated anyway.

Re: Boeing Built Deadly Assumptions into 737 Max, Blind to a Late Design Change

#267

Post by chipsa » Mon, Jun 03, 2019, 1:06 PM UTC

drtillberg wrote: post #70

mikeash wrote: post #13

Earlier quoted context omitted.

If you get a reading of 20 on one and 34 on the other, you disregard both and disable the system. There’s a big difference between a system which must work and a system which must not go wrong. For example, the fly by wire system in an Airbus must work. A failed sensor must not disable the system. Thus, you need at least triple redundancy to keep functioning in the event of a failure. Boeing’s MCAS system, on the oth…

I've read several of these articles about the MAX and I'm not seeing the explanation for how allowing MCAS to fly the plane only on input from AOA sensors (1, 2 or 5) is different from asking pilots to fly the plane with a fogged-up windscreen. Why not cross-check against the true horizon, for example? Doesn't seem safer to unnecessarily disregard context.

True horizon has nothing to do with angle of attack. Angle of attack is the direction the wind is coming from relative to the aircraft. It's possible to have a nose up attitude relative to the horizon, and have the actual aircraft motion be downwards at 10,000 feet per minute.

Re: Boeing Built Deadly Assumptions into 737 Max, Blind to a Late Design Change

#268

Post by bumby » Mon, Jun 03, 2019, 1:40 PM UTC

jplayer01 wrote: post #263

bumby wrote: post #77

Earlier quoted context omitted.

Administrative mitigation like pilots are usually the least preferential ways of mitigating hazards. Humans are often the least consistent, most fallible part of a system. If there were engineering solutions available I would hope Boeing would implement them.

There are many examples of automated systems not accounting for novel or rare situations that the original designers didn't plan for or ignored. This is why manual override should always be available as a last resort if possible. No automated system we can design today is perfect. While protections and automatic mitigation should be implemented, taking away agency from pilots or whoever else is a recipe for disaster.

I wasn't implying that humans should be taken out of the loop. I was more referring to the hierarchy of mitigation. Most preferable are to design the hazard out of the system, followed by engineering controls, and lastly procedural/administrative mitigation.

Too often systems are designed with procedural mitigation as the primary way of controlling a hazard without realizing all the human factors that come into play. Maybe the pilot is distracted because she just had a fight with her spouse. Maybe her co-pilot a bad night's sleep. Or maybe he isn't physically capable generating the force necessary to move the trim wheel.

I think too often designs can over rely on administrative mitigation because the engineering controls seem too costly or difficult to implement. In some cases, this rationalization that a person "just" has to do XYZ activities to control the outcome falls short because we don't acknowledge all the factors that person is dealing with in the moment.

In this case, to someone like me without intimate knowledge of the Boeing process, it looks like they failed at their hazard analysis. They did not design the hazard out of the system (airframe design), the engineering controls were inadequate (MCAS), and the administrative controls were poorly managed (pilots did not understand the procedures for disabling MCAS or the procedures were not capable of being executed effectively). In other words, they did not apply appropriate hazard analysis and mitigation. Hindsight is easy, I know, but when schedule pressure hits a lot of these processes are rushed.

Re: Boeing Built Deadly Assumptions into 737 Max, Blind to a Late Design Change

#269

Post by HyperTalk2 » Mon, Jun 03, 2019, 1:52 PM UTC

bumby wrote: post #79

HyperTalk2 wrote: post #32

Earlier quoted context omitted.

Why only two AoA sensors, then? Why not a hundred?

There are standards for how many independent inputs are needed based on the criticality of the system. It's not just a guess as to how many are sufficient. That's why the categorization of MCAS correctly ('catastrophic' vs. 'hazardous' is important)

No. If you have a hundred AoA sensors, then you know to trust that whatever 90% of them are reporting is the truth. You also know exactly which of the remaining 10% need to be repaired or replaced upon landing.

Re: Boeing Built Deadly Assumptions into 737 Max, Blind to a Late Design Change

#270

Post by sean2 » Mon, Jun 03, 2019, 2:21 PM UTC

Ntrails wrote: post #259

CydeWeys wrote: post #235

Earlier quoted context omitted.

Oooof. Well the real lesson there is that unqualified people (especially children) shouldn't be in the cockpit of an airliner at all. Autopilot can't be made smart enough to determine if the person operating the controls actually knows what they're doing, and thus to follow/ignore them as appropriate.

I mean, pick your poison. Either the humans are more reliable or the computers are. Either way is subject to some level of fallibility.

The wikipedia article calls out that the compounding sequence of issues started when autopilot was silently disabled, so the human system was in control when the pilots did not intend it to be.

I think the critical issue in both cases is that the wrong system was in control against the pilots wishes.

So, the pilots can pick my poison based on their training and best judgement (and maybe not put their children in control?).