Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Boeing Built Deadly Assumptions into 737 Max, Blind to a Late Design Change

nytimes.com

Post reply on HN
Print view View original

41–50 of 280 posts

Re: Boeing Built Deadly Assumptions into 737 Max, Blind to a Late Design Change

#41

Post by cmurf »

Boeing engineers did consider [MCAS activation due to failed sensor] in their safety analysis of the original MCAS. They classified the event as “hazardous,” ... could trigger erroneously less often than once in 10 million flight hours.

The incuriosity of all parties to an event categorized as hazardous is astonishing. Boeing says it's a system that's completely transparent to the pilot, and therefore there is no need to describe a failure that they say would be hazardous. What part of that passes a reasonable smell test? It's safe unless it fails, which would be rare, but if it fails people could die? But meh, it's rare so let's not even find out what would happen if it happened?

Boeing must be compelled to show their work for this probability computation, because it is clearly wrong. And both Boeing and the FAA have to answer why there's no mandatory testing of hazardous events. At least what does a simulator think will happen in various states of perturbed sensor data, and how does a pilot react when not expecting such an event?

Oh, and the part about depending on a single sensor is not, per Boeing, a single point of failure because human pilots are part of the system? That's a gem. The pilots are the backup? This poisonous form of logic is perverse.

Re: Boeing Built Deadly Assumptions into 737 Max, Blind to a Late Design Change

#42

Post by phkahler »

mikeash wrote: post #24
HarryHirsch wrote: post #20

Earlier quoted context omitted.

It’s very unlikely that both would fail simultaneously. Birgenair 301 crashed into the Atlantic because mud dauber wasps built nests in both pitot tubes while the plane was on the ground. It happens.

Airspeed is required for safe flight. The failure on that flight was detected immediately, it just couldn’t be handled. AoA on a 737 MAX is not required for safe flight and the system just needs to refrain from taking any action if it fails.

But MCAS was added because the plane doesn't handle well in some situations.

Re: Boeing Built Deadly Assumptions into 737 Max, Blind to a Late Design Change

#43

Post by kejaed »

kejaed wrote: post #27

I really see this as a failure of the Systems Engineering process. With so many people unaware of the impacts of the changes, it’s up to the systems types to have the big picture view and make sure these sorts of things are taken into account. Especially if as the article says a failure of the AOA sensor on the system would be Hazardous (looks like it was Catastrophic when paired with MCAS in retrospect), that would…

Thinking about this a little more, I also see a failure here in terms of naming things, which I have noticed in my career can be scoffed at but is so important.

As the article says, the function of MCAS changed and its operational envelope was greatly expanded. What if, internally at least, the new system was referred to as MCAS2?

This is somewhere that things can get political, as was exactly the case with the Max, where they did not want anything to be considered a change to the aircraft type, let alone knowing the MCAS system existed in two majorly differing versions.

Re: Boeing Built Deadly Assumptions into 737 Max, Blind to a Late Design Change

#44

Post by oldjokes »

throw7 wrote: post #36

"As part of the fix, Boeing has reworked MCAS to more closely resemble the first version." Be very wary if pilot training is not part of the "fix" to getting the Max back up in the air. If MCAS is being "rolled back" then certain situations such as "The Max wasn’t handling well when nearing stalls at low speeds." come back.

Anything short of admitting "we fundamentally screwed up, and are rethinking the poor decision to pair this engine with this airframe" as well as "we are reviewing all our design processes and how the FAA oversees every step of the process" is unacceptable. MCAS is just the horrific bloody bandage that is peeling away, it's not actually the problem here.

This probably won't happen of course, all they seem to want to do is fix as little as possible as quickly as possible while denying they ever knew anything.

If I were someone powerful like a pilot union leader I would start throwing conniption fits in public and refuse to let my people fly on Max's at all.

Re: Boeing Built Deadly Assumptions into 737 Max, Blind to a Late Design Change

#45

Post by Majromax »

Gibbon1 wrote: post #35
mikeash wrote: post #13

Earlier quoted context omitted.

If you get a reading of 20 on one and 34 on the other, you disregard both and disable the system. There’s a big difference between a system which must work and a system which must not go wrong. For example, the fly by wire system in an Airbus must work. A failed sensor must not disable the system. Thus, you need at least triple redundancy to keep functioning in the event of a failure. Boeing’s MCAS system, on the oth…

> and disable the system When you do that you now have an aircraft the pilots aren't certified to fly.

> When you do that you now have an aircraft the pilots aren't certified to fly.

It would increase risk. But for that increased risk to materialize into harm, the plane would also need to experience an unlikely, near-edge-of-flight-envelope situation that the working MCAS was intended to handle.

This would be comparable to a plane with any other mechanical defect that is discovered in-flight. If the above situation is expected to be too-risky to continue the flight and repair on the ground, then it would give cause for an emergency landing.

Re: Boeing Built Deadly Assumptions into 737 Max, Blind to a Late Design Change

#46

Post by mehrdadn »

csours wrote: post #38

I'm surprised no one has mentioned Therac 25 or Normal Accidents yet. For reference, the Therac 25 was a computer-controlled radiation therapy machine involved in several over-exposures due to replacement of physical controls with computer based ones without complete understanding of the interactions of the controls. The Max feels very much like that. No one can really keep a whole aircraft in their head, much less a…

I don't see these as equivalent, at least not based on what I've learned about the cases (feel free to correct). As I understand, Therac-25 was due to software bug and a genuine design process inadequacy that allowed it to cause a problem, that could happen with people acting entirely in good faith, simply because they didn't know better. That's why they created standards to address the design process. With 737MAX... pretty much literally everyone could tell you the decisions were bad, and so many seem to have been made in bad faith, specifically to e.g. avoid recertification and increase revenues in a pretty reckless manner.

Re: Boeing Built Deadly Assumptions into 737 Max, Blind to a Late Design Change

#47

Post by bonzini »

codedokode wrote: post #5
mikeash wrote: post #4

Earlier quoted context omitted.

The problem isn’t failure, but detecting failure. If the sensor had just stopped responding, there wouldn’t have been any problem. The planes would keep flying, the sensors would get replaced, and everyone would be fine. What happened was that the sensor gave erroneous readings. The MCAS system reacted to those erroneous reading and crashes the plane. With two sensors, you can detect failure. It’s very unlikely that…

It is not unlikely, I don't remember details, but I remember the case when two broken sensors voted over working sensor. The problem is that in order to save tiny amount of money Boing made plane rely on unreliable sensors.

Maybe you're thinking of QF72 where erroneous data was "too wrong" to be smoothed out by the computer?

Re: Boeing Built Deadly Assumptions into 737 Max, Blind to a Late Design Change

#48

Post by CamperBob2 »

oldjokes wrote: post #44
throw7 wrote: post #36

"As part of the fix, Boeing has reworked MCAS to more closely resemble the first version." Be very wary if pilot training is not part of the "fix" to getting the Max back up in the air. If MCAS is being "rolled back" then certain situations such as "The Max wasn’t handling well when nearing stalls at low speeds." come back.

Anything short of admitting "we fundamentally screwed up, and are rethinking the poor decision to pair this engine with this airframe" as well as "we are reviewing all our design processes and how the FAA oversees every step of the process" is unacceptable. MCAS is just the horrific bloody bandage that is peeling away, it's not actually the problem here. This probably won't happen of course, all they seem to want to…

Anything short of admitting "we fundamentally screwed up, and are rethinking the poor decision to pair this engine with this airframe"

Can you cite the basis for this often-expressed sentiment? There's absolutely no reason why a properly-designed and -vetted MCAS system wouldn't have been a perfectly acceptable solution to any handling irregularities caused by the engine configuration.

The idea was fine. The fault was 100% in the implementation.

And no, downvotes are not a valid citation.

Re: Boeing Built Deadly Assumptions into 737 Max, Blind to a Late Design Change

#49

Post by Pxtl »

mikeash wrote: post #4
aivisol wrote: post #2

Is this only me, or all this one-vs-two AoA sensor talk seems some kind of diversion from the real problem with this plane. I mean, if one-sensor based MCAS failed twice so early in the life span of the plane model, what is the probability that a two-sensor model will fail pretty soon as well? The math should be simple, we have all data needed: combined hours flown by all planes of the type and number of failures (at…

The problem isn’t failure, but detecting failure. If the sensor had just stopped responding, there wouldn’t have been any problem. The planes would keep flying, the sensors would get replaced, and everyone would be fine. What happened was that the sensor gave erroneous readings. The MCAS system reacted to those erroneous reading and crashes the plane. With two sensors, you can detect failure. It’s very unlikely that…

That's why you need 5 sensors or so on something this mission-critical. Enough that you can have a clear democratic majority if one or two goes on the fritz.

Re: Boeing Built Deadly Assumptions into 737 Max, Blind to a Late Design Change

#50

Post by Filligree »

phkahler wrote: post #42
mikeash wrote: post #24

Earlier quoted context omitted.

Airspeed is required for safe flight. The failure on that flight was detected immediately, it just couldn’t be handled. AoA on a 737 MAX is not required for safe flight and the system just needs to refrain from taking any action if it fails.

But MCAS was added because the plane doesn't handle well in some situations.

It handles differently, yes. That could be handled with a bit of training.
Post reply on HN