Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Boeing Built Deadly Assumptions into 737 Max, Blind to a Late Design Change

nytimes.com

Post reply on HN
Print view View original

31–40 of 280 posts

Re: Boeing Built Deadly Assumptions into 737 Max, Blind to a Late Design Change

#31

Post by mikeash »

kds3 wrote: post #30
mikeash wrote: post #25

Earlier quoted context omitted.

Can you elaborate on AF447? I’ve never heard of the AoA sensors being connected with that crash, and a quick search indicates that they were working fine.

I've confused AF447's Pitot tubes with AoA sensors. But I think point is still valid: two sensors _can_ simultaneously have same erroneous readings and we have to be sure pilots can handle such situations.

First: I said it’s very unlikely, not impossible. Second: the failure of AF447’s pitot tubes was detected immediately and the system switched to an alternate law as a result; this contributed to the crash because the pilots were less familiar with how the system operated in that mode. Third: AoA sensors operate by a completely different mechanism so even if this was what happened (it wasn’t) this demonstrates nothing relevant.

You’re just badly arguing details while ignoring the actual point here.

Re: Boeing Built Deadly Assumptions into 737 Max, Blind to a Late Design Change

#32

Post by HyperTalk2 »

runciblespoon wrote: post #6

“After Boeing removed one of the sensors from an automated flight system on its 737 Max, the jet’s designers and regulators still proceeded as if there would be two.” No, no, no. This is just more of shifting the blame from Boeing upper management. They couldn't use two Angle of Attack (AOA) sensors as when there was a differing reading there would be no way to know the correct reading, which is why MCAS used a singl…

Why only two AoA sensors, then? Why not a hundred?

Re: Boeing Built Deadly Assumptions into 737 Max, Blind to a Late Design Change

#33

Post by weaksauce »

kds3 wrote: post #21
mikeash wrote: post #19

Earlier quoted context omitted.

If they’re damaged on the ground, surely it’ll be noticed that the sensors are claiming an extreme AoA while just sitting there, and they’ll be fixed. AF447 is an example of a fly by wire system that has to keep working no matter what happens, thus a bunch of redundant systems and a series of alternate modes the system can fall back on to operate in a degraded state. MCAS, in contrast, is not a critical system. It co…

> If they’re damaged on the ground, surely it’ll be noticed that the sensors are claiming an extreme AoA while just sitting there, and they’ll be fixed. AoA sensors by design don't work reliable in low speed and they don't work at all on the ground. > AF447 is an example of a fly by wire system that has to keep working no matter what happens, thus a bunch of redundant systems and a series of alternate modes the syste…

AF447 had two working aoa sensors that never disagreed. It didn’t have an aoa indicator in the cockpit though. You can infer what the aoa is by the vertical airspeed and engine output though. The inputs from left and right stick canceled each other and it power on stalled out of the sky landing belly first. This was pilot error because they had unreliable airspeed indication due to pitot tube icing.

Airspeed is a critical system while aoa is not. (Unless aoa is tied to mcas like in the max jets)

Re: Boeing Built Deadly Assumptions into 737 Max, Blind to a Late Design Change

#34

Post by weaksauce »

kejaed wrote: post #22
empath75 wrote: post #14

Earlier quoted context omitted.

This doesn’t seem correct to me, but I can’t put my finger on why. Surely if both agree that’s more certainty than a single sensor reading. Granted a disagreement would be bad, but at least you would have some warning that one of them is wrong, whereas you would have none at all if relying on a single sensor.

You wouldn’t be able to know which one was wrong but you’d be able to know and annunciate an AOA MISCOMPARE (which was an option on the Max) and then disable MCAS.

Which was not an option to upper management because that would cause training for the event of disengagement and a new type rating.

Re: Boeing Built Deadly Assumptions into 737 Max, Blind to a Late Design Change

#35

Post by Gibbon1 »

mikeash wrote: post #13
runciblespoon wrote: post #10

Earlier quoted context omitted.

> With two sensors, you can detect failure You get a reading of 20 on one sensor and get a reading of 34 on the second, which one is correct. To achieve reliability a minimum of five sensors need be used. four primary and one back-up. If three primary agree then system normal. If two primary disagree then switch to backup.

If you get a reading of 20 on one and 34 on the other, you disregard both and disable the system. There’s a big difference between a system which must work and a system which must not go wrong. For example, the fly by wire system in an Airbus must work. A failed sensor must not disable the system. Thus, you need at least triple redundancy to keep functioning in the event of a failure. Boeing’s MCAS system, on the oth…

> and disable the system

When you do that you now have an aircraft the pilots aren't certified to fly.

Re: Boeing Built Deadly Assumptions into 737 Max, Blind to a Late Design Change

#36

Post by throw7 »

"As part of the fix, Boeing has reworked MCAS to more closely resemble the first version."

Be very wary if pilot training is not part of the "fix" to getting the Max back up in the air. If MCAS is being "rolled back" then certain situations such as "The Max wasn’t handling well when nearing stalls at low speeds." come back.

Re: Boeing Built Deadly Assumptions into 737 Max, Blind to a Late Design Change

#37

Post by aivisol »

CydeWeys wrote: post #18
aivisol wrote: post #15

Earlier quoted context omitted.

Ok, that makes sense. But are the hours at which they got replaced are on order (or several) of magnitude lower than a two-sensor failure can occur? I hope it is calculated.

The point is that, as safety-critical equipment, you can't fly the plane if one is broken. So you'd need to have two fail within a single flight, and fail in the same way, in order to cause an incorrect activation of MCAS. With just one sensor, it's much more likely. Note that Airbus uses three of these sensors on their planes, so that when one fails you know which one it is, and can still rely on the signals from th…

That was my original question. What is the probability of them failing at the same flight in the same way (say they got frozen at the same angle, hit by blizzard, etc, etc). Intuition is that the chances are high given their low MTBF.

Re: Boeing Built Deadly Assumptions into 737 Max, Blind to a Late Design Change

#38

Post by csours »

I'm surprised no one has mentioned Therac 25 or Normal Accidents yet.

For reference, the Therac 25 was a computer-controlled radiation therapy machine involved in several over-exposures due to replacement of physical controls with computer based ones without complete understanding of the interactions of the controls.

The Max feels very much like that. No one can really keep a whole aircraft in their head, much less a whole aircraft development project. We use computers for that, as well as mental heuristics. But if those computers and brains are not fed all the proper data and connections, they will not find the all the problems.

Additionally, there seems to be a lot of the tail wagging the dog. If this system is expected to perform according to X specifications, then by golly it will, and we will show that it does.

https://en.wikipedia.org/wiki/Therac-25

Edit: Please don't take the above as absolution of Boeing. Someone (a lot of someones) really should have known better.

Re: Boeing Built Deadly Assumptions into 737 Max, Blind to a Late Design Change

#39

Post by kds3 »

mikeash wrote: post #31
kds3 wrote: post #30

Earlier quoted context omitted.

I've confused AF447's Pitot tubes with AoA sensors. But I think point is still valid: two sensors _can_ simultaneously have same erroneous readings and we have to be sure pilots can handle such situations.

First: I said it’s very unlikely, not impossible. Second: the failure of AF447’s pitot tubes was detected immediately and the system switched to an alternate law as a result; this contributed to the crash because the pilots were less familiar with how the system operated in that mode. Third: AoA sensors operate by a completely different mechanism so even if this was what happened (it wasn’t) this demonstrates nothing…

> With two sensors, you can detect failure. It’s very unlikely that both would fail simultaneously. If they did, it’s very unlikely that both would provide the same erroneous readings.

> First: I said it’s very unlikely, not impossible.

> You’re just badly arguing details while ignoring the actual point here.

My point here was that with two AoA sensors you can't reliably detect failure. They can both fail simultaneously and provide the same erroneous readings. And because it's not that unlikely we have to be sure that pilots can handle MCAS problems when two AoA sensors fail.

> Second: the failure of AF447’s pitot tubes was detected immediately

Because A330 have three pitot tubes, right? Not two out of two sensors?

I'm not arguing about AF447 case, I gave it as an example that two sensors _can_ have same erroneous readings. Airbus engineers were not sure that can happen in real life, so stall warning issue was a real surprise for them.

Re: Boeing Built Deadly Assumptions into 737 Max, Blind to a Late Design Change

#40

Post by tlb »

piadodjanho wrote: post #17
aivisol wrote: post #2

Is this only me, or all this one-vs-two AoA sensor talk seems some kind of diversion from the real problem with this plane. I mean, if one-sensor based MCAS failed twice so early in the life span of the plane model, what is the probability that a two-sensor model will fail pretty soon as well? The math should be simple, we have all data needed: combined hours flown by all planes of the type and number of failures (at…

I have the impression that people are overlooking the sensors. They are suppose to be very, very, reliable. Two different planes got wrong reading from sensor in the same side, this seems to be a red flag for me. I wonder in what side of the sensor cable the problem is.

They’re not expected to be that reliable. They’re small vanes sticking out the side of the nose, vulnerable to bird strikes. The article mentions hundreds of reported failures over the years. The way to make the system reliable is redundancy.
Post reply on HN