Boeing Built Deadly Assumptions into 737 Max, Blind to a Late Design Change • Hacker News Board

Re: Boeing Built Deadly Assumptions into 737 Max, Blind to a Late Design Change

#61

Post by rightbyte » Sat, Jun 01, 2019, 9:58 PM UTC

Aloha wrote: post #3

aivisol wrote: post #2

Is this only me, or all this one-vs-two AoA sensor talk seems some kind of diversion from the real problem with this plane. I mean, if one-sensor based MCAS failed twice so early in the life span of the plane model, what is the probability that a two-sensor model will fail pretty soon as well? The math should be simple, we have all data needed: combined hours flown by all planes of the type and number of failures (at…

The AOA sensors are effectively a consumable, and would undergo regular replacement over the life of the aircraft, the odds of BOTH of them failing at the same moment in the same flight is very very small.

If they are replaced simultaneously the chance of them simultaneously not working the next take off is non negligible.

Re: Boeing Built Deadly Assumptions into 737 Max, Blind to a Late Design Change

#62

Post by roywiggins » Sat, Jun 01, 2019, 10:14 PM UTC

phkahler wrote: post #42

mikeash wrote: post #24

Earlier quoted context omitted.

Airspeed is required for safe flight. The failure on that flight was detected immediately, it just couldn’t be handled. AoA on a 737 MAX is not required for safe flight and the system just needs to refrain from taking any action if it fails.

But MCAS was added because the plane doesn't handle well in some situations.

It sounds like in normal flight you could cope without it, not easily enough that you'd trust an entire fleet without it, but enough that in the rare case of a detected AoA sensor failure, you could land the thing in a controllable way.

Re: Boeing Built Deadly Assumptions into 737 Max, Blind to a Late Design Change

#63

Post by 2Ccltvcm » Sat, Jun 01, 2019, 10:17 PM UTC

aivisol wrote: post #2

Is this only me, or all this one-vs-two AoA sensor talk seems some kind of diversion from the real problem with this plane. I mean, if one-sensor based MCAS failed twice so early in the life span of the plane model, what is the probability that a two-sensor model will fail pretty soon as well? The math should be simple, we have all data needed: combined hours flown by all planes of the type and number of failures (at…

I want to know why the Boeing flight computer needs pitot tube input at all. Modern ublox GPSes can easily obtain 3D lock on multiple satellite constellations within a minute of booting. Several of these in parallel for redundancy if you are paranoid. Flight controllers on fixed wings don't even need a magnetometer to stabilize. Just GPS path heading. If all else fails, solid state accelerometers are very reliable. Accelerometer only based dead reckoning works great. If all else fails, a single accelerometer should be sufficient to get the plane relatively stable. A barometer can help too, but doesn't seem necessary. These systems can be easily combined with fallback logic to keep the plane in the sky. I just don't understand what is so hard about this for Boeing. I understand airspeed is not the same as ground speed, but this should provide enough information to the flight computer to keep the plane in the air or at least stable.

Re: Boeing Built Deadly Assumptions into 737 Max, Blind to a Late Design Change

#64

Post by jaggirs » Sat, Jun 01, 2019, 10:20 PM UTC

cmurf wrote: post #41

Boeing engineers did consider [MCAS activation due to failed sensor] in their safety analysis of the original MCAS. They classified the event as “hazardous,” ... could trigger erroneously less often than once in 10 million flight hours. The incuriosity of all parties to an event categorized as hazardous is astonishing. Boeing says it's a system that's completely transparent to the pilot, and therefore there is no nee…

If the pilots had recieved training, then they could be a backup. So probably whoever did that safety analysis was assuming pilots would know how and when to turn off the system, but the pilots in fact didn't know this system existed at all.

Re: Boeing Built Deadly Assumptions into 737 Max, Blind to a Late Design Change

#65

Post by K0balt » Sat, Jun 01, 2019, 10:21 PM UTC

Causality1 wrote: post #57

ficklepickle wrote: post #52

This whole plane sounds like any ugly hack. They slapped very different engines on an existing airframe. Then, when it inevitability exhibited undesirable behaviour, they tried to paper over the cracks. Then they hid this information from their customers, regulatory agencies and the pilots. It makes me wonder if there are other issues with the Max that the public doesn't know about yet. I hope a thorough review of Bo…

Indeed. The article makes it sound like a foul-up late in the design process, but this plane was corrupt from the very beginning when Boeing set out to dodge the requirement for re-certifying the airframe.

To be fair, it's not like this isn't standard industry practice. Airframe evolve and change, with incremental changes typically only affecting limited areas of impact.

OTOH seeking a non aerodynamic solution to a significant stability degrading airframe modification was IMHO a bridge too far. If the pitch stability (not the pitch feel) problems couldn't be dealt with aerodymancally without busting type certification, than perhaps the whole concept was just too much of a stretch for the venerable old 737.

It surprises me, though, that this couldn't have been engineered out with enhancements to the horizontal stabilizer, such as tip fences or a span increase to offset the lift from the engine nacelles.

If it could have, but software was cheaper, then that's even a darker indictment of Boeing's engineering incompetence.

Re: Boeing Built Deadly Assumptions into 737 Max, Blind to a Late Design Change

#66

Post by esolyt » Sat, Jun 01, 2019, 10:24 PM UTC

HarryHirsch wrote: post #20

mikeash wrote: post #4

Earlier quoted context omitted.

The problem isn’t failure, but detecting failure. If the sensor had just stopped responding, there wouldn’t have been any problem. The planes would keep flying, the sensors would get replaced, and everyone would be fine. What happened was that the sensor gave erroneous readings. The MCAS system reacted to those erroneous reading and crashes the plane. With two sensors, you can detect failure. It’s very unlikely that…

It’s very unlikely that both would fail simultaneously. Birgenair 301 crashed into the Atlantic because mud dauber wasps built nests in both pitot tubes while the plane was on the ground. It happens.

I think the point is at least both sensors wouldn't fail literally at the same exact second. There would be a period of time where the sensors are disagreeing, and that would alert the pilot about what is going on.

Re: Boeing Built Deadly Assumptions into 737 Max, Blind to a Late Design Change

#67

Post by mnw21cam » Sat, Jun 01, 2019, 10:28 PM UTC

2Ccltvcm wrote: post #63

aivisol wrote: post #2

Is this only me, or all this one-vs-two AoA sensor talk seems some kind of diversion from the real problem with this plane. I mean, if one-sensor based MCAS failed twice so early in the life span of the plane model, what is the probability that a two-sensor model will fail pretty soon as well? The math should be simple, we have all data needed: combined hours flown by all planes of the type and number of failures (at…

I want to know why the Boeing flight computer needs pitot tube input at all. Modern ublox GPSes can easily obtain 3D lock on multiple satellite constellations within a minute of booting. Several of these in parallel for redundancy if you are paranoid. Flight controllers on fixed wings don't even need a magnetometer to stabilize. Just GPS path heading. If all else fails, solid state accelerometers are very reliable. A…

If all you are using is ground-based position/speed, then you are ignoring the very real possibility that the air you are flying through is not stationary relative to the ground. In actual fact, especially at high altitudes, the air can be moving very fast, and the difference between ground speed and airspeed can be the difference between flying and stalling.

Also, your GPS measurements give you position, direction, and speed, but they don't give you orientation. You would have to have another instrument to feed that into the system (such systems exist).

But yes, it would be a sanity check.

Re: Boeing Built Deadly Assumptions into 737 Max, Blind to a Late Design Change

#68

Post by 2Ccltvcm » Sat, Jun 01, 2019, 10:29 PM UTC

mnw21cam wrote: post #67

2Ccltvcm wrote: post #63

Earlier quoted context omitted.

I want to know why the Boeing flight computer needs pitot tube input at all. Modern ublox GPSes can easily obtain 3D lock on multiple satellite constellations within a minute of booting. Several of these in parallel for redundancy if you are paranoid. Flight controllers on fixed wings don't even need a magnetometer to stabilize. Just GPS path heading. If all else fails, solid state accelerometers are very reliable. A…

If all you are using is ground-based position/speed, then you are ignoring the very real possibility that the air you are flying through is not stationary relative to the ground. In actual fact, especially at high altitudes, the air can be moving very fast, and the difference between ground speed and airspeed can be the difference between flying and stalling. Also, your GPS measurements give you position, direction,…

Can a near-stall condition be detected solely with some combination of GPS, accelerometer, and barometer?

Re: Boeing Built Deadly Assumptions into 737 Max, Blind to a Late Design Change

#69

Post by julik » Sat, Jun 01, 2019, 10:30 PM UTC

2Ccltvcm wrote: post #63

aivisol wrote: post #2

Is this only me, or all this one-vs-two AoA sensor talk seems some kind of diversion from the real problem with this plane. I mean, if one-sensor based MCAS failed twice so early in the life span of the plane model, what is the probability that a two-sensor model will fail pretty soon as well? The math should be simple, we have all data needed: combined hours flown by all planes of the type and number of failures (at…

I want to know why the Boeing flight computer needs pitot tube input at all. Modern ublox GPSes can easily obtain 3D lock on multiple satellite constellations within a minute of booting. Several of these in parallel for redundancy if you are paranoid. Flight controllers on fixed wings don't even need a magnetometer to stabilize. Just GPS path heading. If all else fails, solid state accelerometers are very reliable. A…

Additionally the AOA sensor - which is basically a weather vane - does not output usable data before the airflow around the airplane has reached certain velocity (it needs air flowing around it). Which is reported... by the pitot tubes.

Re: Boeing Built Deadly Assumptions into 737 Max, Blind to a Late Design Change

#70

Post by drtillberg » Sat, Jun 01, 2019, 10:31 PM UTC

mikeash wrote: post #13

runciblespoon wrote: post #10

Earlier quoted context omitted.

> With two sensors, you can detect failure You get a reading of 20 on one sensor and get a reading of 34 on the second, which one is correct. To achieve reliability a minimum of five sensors need be used. four primary and one back-up. If three primary agree then system normal. If two primary disagree then switch to backup.

If you get a reading of 20 on one and 34 on the other, you disregard both and disable the system. There’s a big difference between a system which must work and a system which must not go wrong. For example, the fly by wire system in an Airbus must work. A failed sensor must not disable the system. Thus, you need at least triple redundancy to keep functioning in the event of a failure. Boeing’s MCAS system, on the oth…

I've read several of these articles about the MAX and I'm not seeing the explanation for how allowing MCAS to fly the plane only on input from AOA sensors (1, 2 or 5) is different from asking pilots to fly the plane with a fogged-up windscreen. Why not cross-check against the true horizon, for example? Doesn't seem safer to unnecessarily disregard context.