15 ms·

How Boeing, FAA certified the suspect 737 MAX flight control system

228 points by mimixco 8y ago

chmaynard 8y ago
Required reading for anyone interested in understanding what probably went wrong.
mrbonner 8y ago
So this is the equivalence of “let the software engineers do the QA” thing.
- rurban 8y ago
  Nope, software engineers at least have a sense of proper QA. This is the equivalence of “let the product manager do the QA” thing.
  - cratermoon 8y ago
    Even "give the users a beta or MVP product but don't tell them . We'll fix the bugs if they find any"
  - avs733 8y ago
    You are sincerely suggesting that software engineers have a stronger sense of QA than aerospace engineers?
    - rurban 8y ago
      I was automotive engineer and software engineer. Both have a proper sense of QA, both do their own testing and both know what's right and wrong. Bad product managers certainly not.
mannykannot 8y ago
This is a pretty damning statement, with respect to the original safety analysis submitted to the FAA: "The safety analysis... assessed a failure of the system as one level below “catastrophic.” But even that “hazardous” danger level should have precluded activation of the system based on input from a single sensor — and yet that’s how it was designed." Neither Boeing nor the FAA should have given this a pass.
ilamont 8y ago
The FAA, citing lack of funding and resources, has over the years delegated increasing authority to Boeing to take on more of the work of certifying the safety of its own airplanes. How does it work in other countries?
- mannykannot 8y ago
  Many countries effectively delegate it to the FAA.
- deleted 8y ago
  [deleted]
- chmaynard 8y ago
  Funny, I've never heard the FDA make a statement like that. If it takes longer to certify a new pharmaceutical because of lack of resources, so be it. It needs to take longer. Instead of applying pressure on the FAA to cut corners, Boeing and Airbus should lobby Congress to increase FAA funding.
azernik 8y ago
"Both Boeing and the FAA were informed of the specifics of this story and were asked for responses 11 days ago, before the second crash of a 737 MAX last Sunday." i.e. people were following up on this before the public outcry started.
azernik 8y ago
For those who were wondering why pilots didn't override the autopilot? Turns out that just made things worse: ================================================== The discrepancy over this number is magnified by another element in the System Safety Analysis: The limit of the system’s authority to move the tail applies each time MCAS is triggered. And it can be triggered multiple times, as it was on the Lion Air flight. One current FAA safety engineer said that every time the pilots on the Lion Air flight reset the switches on their control columns to pull the nose back up, MCAS would have kicked in again and “allowed new increments of 2.5 degrees.” “So once they pushed a couple of times, they were at full stop,” meaning at the full extent of the tail swivel, he said. Peter Lemme, a former Boeing flight controls engineer who is now an avionics and satellite-communications consultant, said that because MCAS reset each time it was used, “it effectively has unlimited authority.” ... Boeing insists that the pilots on the Lion Air flight should have recognized that the horizontal stabilizer was moving uncommanded, and should have responded with a standard pilot checklist procedure to handle what’s called “stabilizer runaway.” If they’d done so, the pilots would have hit cutoff switches and deactivated the automatic stabilizer movement. Boeing has pointed out that the pilots flying the same plane on the day before the crash experienced similar behavior to Flight 610 and did exactly that: They threw the stabilizer cutoff switches, regained control and continued with the rest of the flight. However, pilots and aviation experts say that what happened on the Lion Air flight doesn’t look like a standard stabilizer runaway, because that is defined as continuous uncommanded movement of the tail. On the accident flight, the tail movement wasn’t continuous; the pilots were able to counter the nose-down movement multiple times. In addition, the MCAS altered the control column response to the stabilizer movement. Pulling back on the column normally interrupts any stabilizer nose-down movement, but with MCAS operating that control column function was disabled. These differences certainly could have confused the Lion Air pilots as to what was going on.
- outworlder 8y ago
  > For those who were wondering why pilots didn't override the autopilot? MCAS only works when autopilot is OFF (and flaps retracted).
  - 8y ago
mimixco 8y ago
Notable and disturbing here is the lack of Max simulators in existence. It looks like neither Lion Air nor Ethiopian nor any US airline had access to one. Also linked in this article is the original FAA table of differences between the Max and other 737 models. It makes no metion of MCAS.
- ajross 8y ago
  Yeah. As much blame as Boeing and the FAA certification process seems to deserve here, it's worth pointing out how much of the cascade of failures is in the airlines and cockpits too. I mean, yes, the trim system was being driven by input from a single nonredundant sensor, which is a violation of the kind of engineering for failure process that airliners should be designed in. But at the same time that trim system is, by design, not strong enough to overpower pilot input to the other control surfaces. I mean, it's supposed to have been possible for the pilot to just fly the aircraft to a landing in the face of outrageous trim problems. But the actual pilots didn't, not because they weren't strong enough to push the yoke but because they simply didn't know what to do and didn't have the presence of mind to just yank hard on the controls. Somehow the culture of "just fly the ?!@#! plane" got lost in all those training iPads.
  - tafda 8y ago
    Not true. https://www.seattletimes.com/business/boeing-aerospace/failed-certification-faa-missed-safety-issues-in-the-737-max-system-implicated-in-the-lion-air-crash/ https://www.seattletimes.com/business/boeing-aerospace/faile... Quote: The discrepancy over this number is magnified by another element in the System Safety Analysis: The limit of the system’s authority to move the tail applies each time MCAS is triggered. And it can be triggered multiple times, as it was on the Lion Air flight. One current FAA safety engineer said that every time the pilots on the Lion Air flight reset the switches on their control columns to pull the nose back up, MCAS would have kicked in again and “allowed new increments of 2.5 degrees.” “So once they pushed a couple of times, they were at full stop,” meaning at the full extent of the tail swivel, he said. Peter Lemme, a former Boeing flight controls engineer who is now an avionics and satellite-communications consultant, said that because MCAS reset each time it was used, “it effectively has unlimited authority.”
Insanity 8y ago
>, “Boeing 737-800 pilots were required to receive some additional training on the MAX 8, which included an hour lesson on some differences. Additional training was not required, as the 737-800 and the MAX 8 have same type certification.” How are those type certifications determined? It seems to me that there should be an instance checking if the type certifications make sense. Or perhaps they did, and they just really look like similar planes. In which case I wonder if the threshold for 'versioning' should be changed. (I know nothing of how this actually works, it just baffles me that seemingly different planes get the same certificate) EDIT: I read the FAA does check this, but I wonder on what _grounds_ it makes the decisions.
- mcv 8y ago
  It makes sense that very minor differences don't require extra training if the differences have no meaningful impact on cockpit design or flight characteristics. But in this case, flight characteristics were clearly different, and MCAS was supposed to compensate for those differences. I don't know how they measure such differences, but you'd think that different engines, different aerodynamics, and a new control system to compensate for those differences, are enough to warrant a new type certification.
  - rob74 8y ago
    well, yes, exactly, MCAS was supposed to compensate for these differences, to make sure that the flight characteristics are close enough to not require additional training. But tragically, what was supposed to be part of the solution turned out to be part of the problem...
  - yason 8y ago
    They should really have type certification diffs. If 90% of the airplane is the same as the previous version, the manufacturer should expect a type certification procedure that costs about 10% of a fully new design and pilots should gain the new type rating with about 10% of the effort and hours of what would be required for a completely new plane. It sounds really cumbersome to have it either-or way, making it difficult to develop planes too much incrementally and keeping it very costly to start from scratch with a completely new design.
kevin_thibedeau 8y ago
I wonder who at Boeing pushed to redesign the landing gear. At this point it would have been the cheaper option.
- 0xffff2 8y ago
  Redesigning the landing gear means redesigning the wing. I'm not an aerospace engineer, but I do work at an aerospace organization. I've been told my multiple AE's that redesigning the wing is basically the same amount of work as designing a new plane from scratch. In light of that, I'm still not sure we're there yet in terms of purely monetary costs.
- vpribish 8y ago
  they did
stcredzero 8y ago
There is a big difference between how you behave when you're calm, vs how you behave when you're under stress. Basically, you start hitting sub-sentient "defaults." You default to your training. You default to inherited flight or fight behaviors. Emergency procedures and training need to be designed with this in mind, or they will fail. (Presentation preparation is like this. My last presentation failed because by self-training wasn't designed with this in mind.)
- Numberwang 8y ago
  How would you design presentation preparation with that in mind? Or anything for that matter?
  - stcredzero 8y ago
    How would you design presentation preparation with that in mind? Rehearse. Repetition strengthens associations and so increases the chance that you will fall into the same behavior. Or anything for that matter? Masaad Ayoob revolutionized police gunfighting techniques by simplifying movements and changing techniques to more closely resemble the natural stance people take when in the "Fight or Flight" mode. When an airplane is diving into the ground, the natural inclination for pilots is to pull back on the stick. Making the override resemble this would be a way of following this design principle. I think the situation which caused the accident is a bit more complicated and nuanced than just that idea, however.
- penagwin 8y ago
  Unrelated but "Fight or Flight" is actually a great pun for pilots that I never thought of before.
- organsnyder 8y ago
  I had an organ teacher that (gently) reprimanded me at a lesson after I exclaimed, "But it went great while I was practicing!" after making some mistakes while playing through a piece. Yes, I might have learned it to the point that I could play it well under no pressure, but I hadn't learned it to the point that I could do the same during a lesson—let alone a performance. Even with pilots aware of the MCAS system, I don't see how anything short of simulator time can really make these planes safe.
argd678 8y ago
With all the sensors on an aircraft, obviously the ones physical exposed out side the aircraft are more likely to malfunction, but I’m sure there are many unexpected behaviors that have yet to be discovered when other sensors fail too.
Simulacra 8y ago
This will all fall on the shoulders of Boeing. They installed a feature without properly notifying pilots and airlines. Thus when things went haywire, the pilots had no idea what was going on.
- ineedasername 8y ago
  Hopefully it will also fall in part on the FAA, which greenlit the thing for use without checks that might have caught this.
  - chappi42 8y ago
    And will it also fall in part on the passengers who demand cheap and cheaper air fares? (Not only to the detriment of their own safety but also to further increasing ecological debts).
    - masklinn 8y ago
      On the passengers directly I wouldn't expect so, the passengers didn't keep demanding reuse of the same old airframe. It might fall on the airlines, especially Southwest which refuses to fly anything but 737 and thus keeps demanding new ever more altered revisions of the same original frame without type change. But even then at the end of the day if Boeing can't fulfil those demands properly and ethically they are the ones to blame. In the aggregate, consumers will likely flock to the cheaper version of commodities, that doesn't mean it's legal let alone ethical to e.g. sell talc full of asbestos because that's cheaper than selling asbestos-free talc.
    - gdubs 8y ago
      I started to compose a reply to your comment, and it turned out to be a deceptively hard question to answer. My attempt at a succinct answer is that carbon should be more expensive, and that Boeing very likely moved too aggressively to meet the market with a more fuel efficient plane. In some ways – based on my probably naive understanding – consumer desire for a cheaper flight results in increased fuel efficiency, since the cost of flying is heavily dependent on the cost of fuel. Environmentally speaking, that's good. However, better fuel efficiency resulting in cheaper flights leads to people flying more. That's bad. Pricing carbon to reflect its true environmental cost could fix that issue, by raising the price floor. Consumer choice would still drive higher efficiency, but ideally the overall higher cost of carbon would keep flying to a 'sustainable' rate. (Whatever that turns out to be.) What I don't have a clear sense of is whether point-to-point travel with planes like the Max are better for the environment. Theoretically, hub-and-spoke travel is more fuel efficient. The reality ends up being more complicated, with airlines flying half-empty 747s. From what I understand, that makes airlines like Southwest (which operates point-to-point) more fuel efficient. But I'd love to hear a more clear explanation from someone who better understands the subject.
linuxftw 8y ago
This article seems to be second-hand reporting some of the information originally broken here [1]. There's a lot of damning information, not only for Boeing, but also a lot of negligence at the FAA for pushing engineers to 'delegate' reviews of certain components back to Boeing themselves. [1] https://www.seattletimes.com/business/boeing-aerospace/failed-certification-faa-missed-safety-issues-in-the-737-max-system-implicated-in-the-lion-air-crash/ https://www.seattletimes.com/business/boeing-aerospace/faile...
- GuB-42 8y ago
  AFAIK, the FAA, like many regulating bodies take everything at face value, making sure they are not getting lied to isn't their jobs. An audit usually goes like: "I see that you mentioned a change in document X, show me the corresponding test report", "who is responsible for that part?", "does document Y match document X, as required by norm Z?". They will never check that you actually did the tests, or that the analysis is correct. Only that the paperwork is done correctly and that the person responsible is identified. Their field of expertise is in the process, not software or mechanical engineering. But now that they have a list of names, and if one of them rubberstamped something that wasn't actually done, things won't go well for him. It can get really serious, possibly resulting in prison time, so managers usually don't that this duty lightly.
  - linuxftw 8y ago
    > AFAIK, the FAA, like many regulating bodies take everything at face value, making sure they are not getting lied to isn't their jobs. I don't think this is accurate whatsoever. USDA has inspections all the time, they don't just check a report you file with them and go "Oh yeah, they know what they're doing over there." Similar with other industries. If a regulatory body doesn't validate the tests of a manufacturer, what good is that body?
    - michaelcampbell 8y ago
      > > AFAIK, the FAA, like many regulating bodies take everything at face value, making sure they are not getting lied to isn't their jobs. > I don't think this is accurate whatsoever. Which part, that the FAA encourages delegation to Boeing? This is established, AFAIK.
wnevets 8y ago
>FAA for pushing engineers to 'delegate' reviews of certain components back to Boeing themselves. How much more proof do we need as a society that self regulation is a fool's errand?
- ineedasername 8y ago
  Unfortunately, regulation doesn't fit with the narrative of self-determination and "pull yourself up by your bootstraps" Instead the narrative is about big, bloated bureaucracies, ignoring the fact that they got so big by having to respond and add additional layers every time someone figured out a new way to screw things up, as with Boeing.
  - dmix 8y ago
    I've never heard anyone criticizing the size of the FAA or calls for airplane manufacturers to be deregulated. Do you have examples of this? Or are you just making a general politicized point about deregulation? On the other hand I've seen many people complain about "regulatory capture" between FAA + Boeing repeatedly. That's even on the Wikipedia for FAA. > The FAA has been cited as an example of regulatory capture, "in which the airline industry openly dictates to its regulators its governing rules, arranging for not only beneficial regulation, but placing key people to head these regulators." Which is an entirely different problem than a culture of "pulling up your bootstraps". https://en.wikipedia.org/wiki/Federal_Aviation_Administration https://en.wikipedia.org/wiki/Federal_Aviation_Administratio...
    - ineedasername 8y ago
      Yes, I have an example. The parent comment was about regulation in general, and mine was in response to that. However, there was the massive deregulation of the FAA in 1978 due to this sort of pressure. It had one effect of creating more competition in the industry, but it arguably went too far and has had an impact on safety as well. [0] [0] https://www.brookings.edu/opinions/perspective-on-airline-safety-deregulation-increases-risk/ https://www.brookings.edu/opinions/perspective-on-airline-sa...
jcims 8y ago
Unvetted image comparison of the cockpits 737 MAX 8 Cockpit - https://i2.wp.com/thepointsguy.com/wp-content/uploads/2017/06/IMG-Norwegian-Air-Boeing-737-MAX-8-cockpit.jpg https://i2.wp.com/thepointsguy.com/wp-content/uploads/2017/0... 737 800 Cockpit - https://i.imgur.com/eRULoST.jpg https://i.imgur.com/eRULoST.jpg I don't really know my way around an airliner but the key displays seem to be quite different and there's a lot fewer knobs on the MAX 8.
- brozaman 8y ago
  I don't know nearly enough to have a respectable opinion on this, but those screens can display different information configured to display different information at the user's choice. Here you have another max 8 with a completely different layout on those screens: http://www.driven-technologies.com/images/bt_portfolio/52/original/82d7d6b3d0dfab66726be2fc2f2a3833.jpeg http://www.driven-technologies.com/images/bt_portfolio/52/or...
  - racingmars 8y ago
    That's a 787, not 737 at all...
- VBprogrammer 8y ago
  Most of those knobs below the glare shield are things like dimming the displays, setting what appears on each display (notable as there was an AIRS report from a pilot who struggled with the displays and presentation). But the key controls in these accidents are identical. Namely the electronic trim on the yoke, the trim wheels in the middle and the cut-off switches to the right and below the throttles.
- deleted 8y ago
  [deleted]
- WalterBright 8y ago
  Note the two black wheels on either side of the center console. These spin and make a loud clacking sound when the stabilizer trim is running. It should have been quite obvious that the trim action was what was causing the pitch down.
trt808 8y ago
So what's the most likely outcome for all the grounded planes at this point? As someone who has some fear of flying I'll definitely make sure none of my trips include a 737 max in the future, no matter how many patches or upgrades boeing releases
- ceejayoz 8y ago
  They'll be patched to take input from both angle-of-attack sensors (it has two, but the MCAS only used input from one of them) and limit how much the MCAS can override pilot input. I'd be more concerned by the regulatory capture that permitted this to happen than the specific model of aircraft.
- mey 8y ago
  It is very unlikely they will be scraped. There isn't just a handful out there, but more than 300. https://en.m.wikipedia.org/wiki/List_of_Boeing_737_MAX_orders_and_deliveries https://en.m.wikipedia.org/wiki/List_of_Boeing_737_MAX_order... My uninformed assumption is that once a suitable issue is isolated some sort of remediation (training/software/airframe/cockpit) all under the onset of various international gov bodies. No idea if the is a 1 year or 5 year process.
  - sokoloff 8y ago
    I would expect them to be flying prior to the end of the year. The airplane has two AoA inputs and, between that and limiting the authority of the MCAS and adding an MCAS indicator on the panel, I suspect this is a short, mostly flight control software patch. ("Short" in aviation still might be 3 months.)
    - ceejayoz 8y ago
      They might be able to get away with requiring additional training in the meantime, as well. There are big PR risks in that approach, though.
- kalleboo 8y ago
  https://www.seattletimes.com/business/boeing-aerospace/failed-certification-faa-missed-safety-issues-in-the-737-max-system-implicated-in-the-lion-air-crash/ https://www.seattletimes.com/business/boeing-aerospace/faile... > According to a detailed FAA briefing to legislators, Boeing will change the MCAS software to give the system input from both angle-of-attack sensors. > It will also limit how much MCAS can move the horizontal tail in response to an erroneous signal. And when activated, the system will kick in only for one cycle, rather than multiple times. > Boeing also plans to update pilot training requirements and flight crew manuals to include MCAS. > These proposed changes mirror the critique made by the safety engineers in this story. They had spoken to The Seattle Times before the Ethiopian crash. > The FAA said it will mandate Boeing’s software fix in an airworthiness directive no later than April. After the fixes are implemented I wouldn't worry too much about it. Lots of planes have had terrible design flaws that were fixed. The pre-MAX 737 included.
chasely 8y ago
Is there a way to figure out where the 737Max is still being flown? I ask selfishly as I have a flight on Norwegian Air Argentina coming up and according to their seat map I appear to be on a 737 Max8, but there is no indication about the actual metal being flown for their flights, as far as I can tell. Norwegian suspended its use of the 737 Max8 for their main airline, but I haven’t seen anything about their use on their subsidiary airlines.
- trimbo 8y ago
  It is grounded worldwide
  - chasely 8y ago
    So it is. Thanks.
cratermoon 8y ago
tl;dr: Boeing said, "trust us", FAA said, "OK cool, less work for us. Golf Friday?"
deleted 8y ago
[deleted]
danaliv 8y ago
These crashes are captivating, especially given how astonishingly safe air travel has been in the past decade or so. If I remember correctly 2017 was the safest year in the history of aviation. And airplanes, particularly modern jets, are fascinating no matter what they're doing. I remember twenty, thirty years ago looking out the towering floor-to-ceiling windows at the airport, marveling at how many different technological fields had to come together to make air travel possible: materials, energy, engineering, radio, logistics, physics, process control, weather prediction, mapping, software development—nowadays even spaceflight and the freakin' theory of relativity come into play where GPS is in use. As a budding geek it was (and still is) catnip. And then these two MAX jets go down within months of each other. Three hundred and forty six people killed. Three hundred and forty six families shattered, forever. When I think about them, I'm reminded that these weren't just malfunctions to be debugged in my terminal, these were three hundred and forty six tragedies that will ripple out to their friends, families, coworkers, and beyond, for decades to come. I wonder if we are being hasty in our speculation about the causes. I know we are all intensely curious—that intense curiosity is, I think, a defining feature of the community that frequents this site, and something a lot of us owe our successes to. I notice though a tendency for speculation to evolve into factual claims through repetition, and I wonder if we should be more careful not to allow repetition to take the place of evidence. Accident investigation is a slow process, and slow processes are frustrating. Information comes in a trickle. It's natural to want to piece together whatever details we have, wherever we can find them. In our hunger to find out what happened, how these 346 people lost their lives, let's not lose sight of the fact that the information we have right now is incomplete. Let's also not lose sight of the fact that we are talking about people. For the loved ones, this isn't an interesting puzzle; this is a gut-wrenching sorrow. I try to keep that at the center whenever someone asks me what I think about these crashes. I'm glad the MAX is grounded. And I'm intensely curious about what happened. I try to temper my thoughts on the matter according to the amount and quality of information I have, and the degree of knowledge and experience I've acquired. I don't always succeed. But I can at least rest easy knowing that the investigative team has access to a wealth of information and experience, and that they will make their data and findings public when their work is complete.
- linuxftw 8y ago
Merrill 8y ago
How did Boeing decide to kill the 757 and to continually delay the "New Midsize Airplane", and to progressively extend and modify the 737 until it reached 757 size in the 737 MAX 9? I would bet good money that there is a wonderful book to be written about competing design teams, rival marketing plans, and mahogany row politics at Boeing about events resulting in the MAX kludge. Also: "An airline pilot reveals why a plane Boeing discarded 12 years ago is the one they desperately need" https://www.businessinsider.com/boeing-757-pilot-reveals-737-not-replacement-2016-11 https://www.businessinsider.com/boeing-757-pilot-reveals-737...
- zymhan 8y ago
  Because having a single "Type Rating" allows pilots to work 3 generations of 737 at a given time, meaning airlines don't need to train their pilots as much or hire new ones with the required type ratings.
- masklinn 8y ago
  > How did Boeing decide to kill the 757 and to continually delay the "New Midsize Airplane", and to progressively extend and modify the 737 until it reached 757 size in the 737 MAX 9? > Southwest Airlines has only operated Boeing 737 jetliner models, except for a period from 1979 to 1987 I expect that sort of things was part of the decision. Even more so as Boeing never really try to unify their offering and provide airbus-style CCQ[0][1] so there is a very strong incentive & pressure to update frames and keep them in the same rating to avoid crew retraining costs. [0] moving from an A320 to an A380 can take as little as 15 days, other moves are much shorter (down to 2 days CCQ for — I believe — moving between the A330 and the A340) [1] boeing does have some common type rating courses but only between a few pairs e.g. between the 757 and 767, or from the 777 to the 787
vpribish 8y ago
Since I keep seeing partially-informed comments about 737 pitch controls here's some notes and terms and links: It's not obvious, it's not simple, and other planes work in other ways - you can not just assume the 737MAX is like them. The 737 horizontal tail externally looks like 3 moving parts:front-to-back (and large to small) is: Stabilizer : Elevator : Balance Tab. see here: http://www.b737.org.uk/flightcontrols.htm#Pitch http://www.b737.org.uk/flightcontrols.htm#Pitch Stabilizer moves in response to trim - this is what we are mostly looking at. Elevator moves in response to the control column. Balance tab has several modes depending on flaps and hydraulic system health - but it mostly serves to offset aerodynamic force on the elevator in case the hydraulics fail and the elevator has to be controlled manually. (there is one other pitch control, I learned - the spoilers on the wing can give some help in landing in case the elevator controls fail.) There are many modes of operation and simple generalizations will not help.
starpilot 8y ago
EASA and other nations' aviation regulators are also on the hook for not validating this certification as thoroughly as they could have.
- azernik 8y ago
  Everyone trusted the FAA. So much for that.
Animats 8y ago
Well, now we know. Boeing has blown a reputation for quality they had for half a century. The Cormac C919 just got a big boost.
jussij 8y ago
The details provided by the article read rather badly for Boeing for several reasons. Firstly, I think the whole issue is not going away any time soon which is bad enough. But what looks worse is the article points to high levels of incompetence, if not gross negligence in the design and testing of the MCAS. Like all 737s, the MAX actually has two of the sensors, one on each side of the fuselage near the cockpit. But the MCAS was designed to take a reading from only one of them. Lemme said Boeing could have designed the system to compare the readings from the two vanes, which would have indicated if one of them was way off. Alternatively, the system could have been designed to check that the angle-of-attack reading was accurate while the plane was taxiing on the ground before takeoff, when the angle of attack should read zero. I can see this headed to the courts and if the details in the article are found to be correct, there's a good chance Boeing would be up for a rather big settlement, not to mention a massive dent to their reputation
- dboreham 8y ago
  I think the underlying problem is that a control system was designed with the assumption that its purpose was to make the pilot force feedback feel right, for regulatory compliance reasons. Therefore it was designed with low reliability requirements, presumably on the basis that if it doesn't work, no biggie because it's only there to make the controls feel right, and that only happens when the plane is about to stall, which never happens... Then...it turned out that when this control system malfunctions (which is can, quite often, due to aforementioned low reliability requirements), it will actually crash the plane. The lesson is probably: make sure that some system you're designing with low reliability characteristics (only uses one sensor, doesn't have redundant power supplies...) will fail with safe or benign outcomes.
cashsterling 8y ago
I am losing my mind over some of this (and trying to reserve some judgement because we don't have all of the facts yet). In the age where "engineers": (1) can automatically land a "VW bug sized" rover on Mars (2) can land booster rockets practically from orbit (3) can make an adaptive flight control system that can fly a drone even when half a wing is blown clean off mid-flight (on purpose). https://www.youtube.com/watch?time_continue=1&v=JyyN-qWWNfQ https://www.youtube.com/watch?time_continue=1&v=JyyN-qWWNfQ How does this MCAS system, as part of a larger flight dynamics system, have so little understanding of what the hell it is doing to the flight dynamics? I am beyond confused...
aidenn0 8y ago
For those curious about catastrophic vs. hazardous, the standard being used is DO-178B[1] 1: https://en.wikipedia.org/wiki/DO-178B https://en.wikipedia.org/wiki/DO-178B

228 points by mimixco 8y ago

chmaynard 8y ago

Required reading for anyone interested in understanding what probably went wrong.

mrbonner 8y ago

So this is the equivalence of “let the software engineers do the QA” thing.

rurban 8y ago
Nope, software engineers at least have a sense of proper QA. This is the equivalence of “let the product manager do the QA” thing.
- cratermoon 8y ago
  Even "give the users a beta or MVP product but don't tell them . We'll fix the bugs if they find any"
- avs733 8y ago
  You are sincerely suggesting that software engineers have a stronger sense of QA than aerospace engineers?
  - rurban 8y ago
    I was automotive engineer and software engineer. Both have a proper sense of QA, both do their own testing and both know what's right and wrong. Bad product managers certainly not.

mannykannot 8y ago

This is a pretty damning statement, with respect to the original safety analysis submitted to the FAA: "The safety analysis... assessed a failure of the system as one level below “catastrophic.” But even that “hazardous” danger level should have precluded activation of the system based on input from a single sensor — and yet that’s how it was designed." Neither Boeing nor the FAA should have given this a pass.

ilamont 8y ago

The FAA, citing lack of funding and resources, has over the years delegated increasing authority to Boeing to take on more of the work of certifying the safety of its own airplanes. How does it work in other countries?

mannykannot 8y ago
Many countries effectively delegate it to the FAA.
deleted 8y ago
[deleted]
chmaynard 8y ago
Funny, I've never heard the FDA make a statement like that. If it takes longer to certify a new pharmaceutical because of lack of resources, so be it. It needs to take longer. Instead of applying pressure on the FAA to cut corners, Boeing and Airbus should lobby Congress to increase FAA funding.

azernik 8y ago

"Both Boeing and the FAA were informed of the specifics of this story and were asked for responses 11 days ago, before the second crash of a 737 MAX last Sunday." i.e. people were following up on this before the public outcry started.

azernik 8y ago

For those who were wondering why pilots didn't override the autopilot? Turns out that just made things worse: ================================================== The discrepancy over this number is magnified by another element in the System Safety Analysis: The limit of the system’s authority to move the tail applies each time MCAS is triggered. And it can be triggered multiple times, as it was on the Lion Air flight. One current FAA safety engineer said that every time the pilots on the Lion Air flight reset the switches on their control columns to pull the nose back up, MCAS would have kicked in again and “allowed new increments of 2.5 degrees.” “So once they pushed a couple of times, they were at full stop,” meaning at the full extent of the tail swivel, he said. Peter Lemme, a former Boeing flight controls engineer who is now an avionics and satellite-communications consultant, said that because MCAS reset each time it was used, “it effectively has unlimited authority.” ... Boeing insists that the pilots on the Lion Air flight should have recognized that the horizontal stabilizer was moving uncommanded, and should have responded with a standard pilot checklist procedure to handle what’s called “stabilizer runaway.” If they’d done so, the pilots would have hit cutoff switches and deactivated the automatic stabilizer movement. Boeing has pointed out that the pilots flying the same plane on the day before the crash experienced similar behavior to Flight 610 and did exactly that: They threw the stabilizer cutoff switches, regained control and continued with the rest of the flight. However, pilots and aviation experts say that what happened on the Lion Air flight doesn’t look like a standard stabilizer runaway, because that is defined as continuous uncommanded movement of the tail. On the accident flight, the tail movement wasn’t continuous; the pilots were able to counter the nose-down movement multiple times. In addition, the MCAS altered the control column response to the stabilizer movement. Pulling back on the column normally interrupts any stabilizer nose-down movement, but with MCAS operating that control column function was disabled. These differences certainly could have confused the Lion Air pilots as to what was going on.

outworlder 8y ago
> For those who were wondering why pilots didn't override the autopilot? MCAS only works when autopilot is OFF (and flaps retracted).
- 8y ago

mimixco 8y ago

Notable and disturbing here is the lack of Max simulators in existence. It looks like neither Lion Air nor Ethiopian nor any US airline had access to one. Also linked in this article is the original FAA table of differences between the Max and other 737 models. It makes no metion of MCAS.

ajross 8y ago
Yeah. As much blame as Boeing and the FAA certification process seems to deserve here, it's worth pointing out how much of the cascade of failures is in the airlines and cockpits too. I mean, yes, the trim system was being driven by input from a single nonredundant sensor, which is a violation of the kind of engineering for failure process that airliners should be designed in. But at the same time that trim system is, by design, not strong enough to overpower pilot input to the other control surfaces. I mean, it's supposed to have been possible for the pilot to just fly the aircraft to a landing in the face of outrageous trim problems. But the actual pilots didn't, not because they weren't strong enough to push the yoke but because they simply didn't know what to do and didn't have the presence of mind to just yank hard on the controls. Somehow the culture of "just fly the ?!@#! plane" got lost in all those training iPads.
- tafda 8y ago
  Not true. https://www.seattletimes.com/business/boeing-aerospace/failed-certification-faa-missed-safety-issues-in-the-737-max-system-implicated-in-the-lion-air-crash/ https://www.seattletimes.com/business/boeing-aerospace/faile... Quote: The discrepancy over this number is magnified by another element in the System Safety Analysis: The limit of the system’s authority to move the tail applies each time MCAS is triggered. And it can be triggered multiple times, as it was on the Lion Air flight. One current FAA safety engineer said that every time the pilots on the Lion Air flight reset the switches on their control columns to pull the nose back up, MCAS would have kicked in again and “allowed new increments of 2.5 degrees.” “So once they pushed a couple of times, they were at full stop,” meaning at the full extent of the tail swivel, he said. Peter Lemme, a former Boeing flight controls engineer who is now an avionics and satellite-communications consultant, said that because MCAS reset each time it was used, “it effectively has unlimited authority.”

Insanity 8y ago

>, “Boeing 737-800 pilots were required to receive some additional training on the MAX 8, which included an hour lesson on some differences. Additional training was not required, as the 737-800 and the MAX 8 have same type certification.” How are those type certifications determined? It seems to me that there should be an instance checking if the type certifications make sense. Or perhaps they did, and they just really look like similar planes. In which case I wonder if the threshold for 'versioning' should be changed. (I know nothing of how this actually works, it just baffles me that seemingly different planes get the same certificate) EDIT: I read the FAA does check this, but I wonder on what _grounds_ it makes the decisions.

mcv 8y ago
It makes sense that very minor differences don't require extra training if the differences have no meaningful impact on cockpit design or flight characteristics. But in this case, flight characteristics were clearly different, and MCAS was supposed to compensate for those differences. I don't know how they measure such differences, but you'd think that different engines, different aerodynamics, and a new control system to compensate for those differences, are enough to warrant a new type certification.
- rob74 8y ago
  well, yes, exactly, MCAS was supposed to compensate for these differences, to make sure that the flight characteristics are close enough to not require additional training. But tragically, what was supposed to be part of the solution turned out to be part of the problem...
- yason 8y ago
  They should really have type certification diffs. If 90% of the airplane is the same as the previous version, the manufacturer should expect a type certification procedure that costs about 10% of a fully new design and pilots should gain the new type rating with about 10% of the effort and hours of what would be required for a completely new plane. It sounds really cumbersome to have it either-or way, making it difficult to develop planes too much incrementally and keeping it very costly to start from scratch with a completely new design.

kevin_thibedeau 8y ago

I wonder who at Boeing pushed to redesign the landing gear. At this point it would have been the cheaper option.

0xffff2 8y ago
Redesigning the landing gear means redesigning the wing. I'm not an aerospace engineer, but I do work at an aerospace organization. I've been told my multiple AE's that redesigning the wing is basically the same amount of work as designing a new plane from scratch. In light of that, I'm still not sure we're there yet in terms of purely monetary costs.
vpribish 8y ago
they did

stcredzero 8y ago

There is a big difference between how you behave when you're calm, vs how you behave when you're under stress. Basically, you start hitting sub-sentient "defaults." You default to your training. You default to inherited flight or fight behaviors. Emergency procedures and training need to be designed with this in mind, or they will fail. (Presentation preparation is like this. My last presentation failed because by self-training wasn't designed with this in mind.)

Numberwang 8y ago
How would you design presentation preparation with that in mind? Or anything for that matter?
- stcredzero 8y ago
  How would you design presentation preparation with that in mind? Rehearse. Repetition strengthens associations and so increases the chance that you will fall into the same behavior. Or anything for that matter? Masaad Ayoob revolutionized police gunfighting techniques by simplifying movements and changing techniques to more closely resemble the natural stance people take when in the "Fight or Flight" mode. When an airplane is diving into the ground, the natural inclination for pilots is to pull back on the stick. Making the override resemble this would be a way of following this design principle. I think the situation which caused the accident is a bit more complicated and nuanced than just that idea, however.
penagwin 8y ago
Unrelated but "Fight or Flight" is actually a great pun for pilots that I never thought of before.
organsnyder 8y ago
I had an organ teacher that (gently) reprimanded me at a lesson after I exclaimed, "But it went great while I was practicing!" after making some mistakes while playing through a piece. Yes, I might have learned it to the point that I could play it well under no pressure, but I hadn't learned it to the point that I could do the same during a lesson—let alone a performance. Even with pilots aware of the MCAS system, I don't see how anything short of simulator time can really make these planes safe.

argd678 8y ago

With all the sensors on an aircraft, obviously the ones physical exposed out side the aircraft are more likely to malfunction, but I’m sure there are many unexpected behaviors that have yet to be discovered when other sensors fail too.

Simulacra 8y ago

This will all fall on the shoulders of Boeing. They installed a feature without properly notifying pilots and airlines. Thus when things went haywire, the pilots had no idea what was going on.

ineedasername 8y ago
Hopefully it will also fall in part on the FAA, which greenlit the thing for use without checks that might have caught this.
- chappi42 8y ago
  And will it also fall in part on the passengers who demand cheap and cheaper air fares? (Not only to the detriment of their own safety but also to further increasing ecological debts).
  - masklinn 8y ago
    On the passengers directly I wouldn't expect so, the passengers didn't keep demanding reuse of the same old airframe. It might fall on the airlines, especially Southwest which refuses to fly anything but 737 and thus keeps demanding new ever more altered revisions of the same original frame without type change. But even then at the end of the day if Boeing can't fulfil those demands properly and ethically they are the ones to blame. In the aggregate, consumers will likely flock to the cheaper version of commodities, that doesn't mean it's legal let alone ethical to e.g. sell talc full of asbestos because that's cheaper than selling asbestos-free talc.
  - gdubs 8y ago
    I started to compose a reply to your comment, and it turned out to be a deceptively hard question to answer. My attempt at a succinct answer is that carbon should be more expensive, and that Boeing very likely moved too aggressively to meet the market with a more fuel efficient plane. In some ways – based on my probably naive understanding – consumer desire for a cheaper flight results in increased fuel efficiency, since the cost of flying is heavily dependent on the cost of fuel. Environmentally speaking, that's good. However, better fuel efficiency resulting in cheaper flights leads to people flying more. That's bad. Pricing carbon to reflect its true environmental cost could fix that issue, by raising the price floor. Consumer choice would still drive higher efficiency, but ideally the overall higher cost of carbon would keep flying to a 'sustainable' rate. (Whatever that turns out to be.) What I don't have a clear sense of is whether point-to-point travel with planes like the Max are better for the environment. Theoretically, hub-and-spoke travel is more fuel efficient. The reality ends up being more complicated, with airlines flying half-empty 747s. From what I understand, that makes airlines like Southwest (which operates point-to-point) more fuel efficient. But I'd love to hear a more clear explanation from someone who better understands the subject.

linuxftw 8y ago

This article seems to be second-hand reporting some of the information originally broken here [1]. There's a lot of damning information, not only for Boeing, but also a lot of negligence at the FAA for pushing engineers to 'delegate' reviews of certain components back to Boeing themselves. [1] https://www.seattletimes.com/business/boeing-aerospace/failed-certification-faa-missed-safety-issues-in-the-737-max-system-implicated-in-the-lion-air-crash/ https://www.seattletimes.com/business/boeing-aerospace/faile...

GuB-42 8y ago
AFAIK, the FAA, like many regulating bodies take everything at face value, making sure they are not getting lied to isn't their jobs. An audit usually goes like: "I see that you mentioned a change in document X, show me the corresponding test report", "who is responsible for that part?", "does document Y match document X, as required by norm Z?". They will never check that you actually did the tests, or that the analysis is correct. Only that the paperwork is done correctly and that the person responsible is identified. Their field of expertise is in the process, not software or mechanical engineering. But now that they have a list of names, and if one of them rubberstamped something that wasn't actually done, things won't go well for him. It can get really serious, possibly resulting in prison time, so managers usually don't that this duty lightly.
- linuxftw 8y ago
  > AFAIK, the FAA, like many regulating bodies take everything at face value, making sure they are not getting lied to isn't their jobs. I don't think this is accurate whatsoever. USDA has inspections all the time, they don't just check a report you file with them and go "Oh yeah, they know what they're doing over there." Similar with other industries. If a regulatory body doesn't validate the tests of a manufacturer, what good is that body?
  - michaelcampbell 8y ago
    > > AFAIK, the FAA, like many regulating bodies take everything at face value, making sure they are not getting lied to isn't their jobs. > I don't think this is accurate whatsoever. Which part, that the FAA encourages delegation to Boeing? This is established, AFAIK.

wnevets 8y ago

>FAA for pushing engineers to 'delegate' reviews of certain components back to Boeing themselves. How much more proof do we need as a society that self regulation is a fool's errand?

ineedasername 8y ago
Unfortunately, regulation doesn't fit with the narrative of self-determination and "pull yourself up by your bootstraps" Instead the narrative is about big, bloated bureaucracies, ignoring the fact that they got so big by having to respond and add additional layers every time someone figured out a new way to screw things up, as with Boeing.
- dmix 8y ago
  I've never heard anyone criticizing the size of the FAA or calls for airplane manufacturers to be deregulated. Do you have examples of this? Or are you just making a general politicized point about deregulation? On the other hand I've seen many people complain about "regulatory capture" between FAA + Boeing repeatedly. That's even on the Wikipedia for FAA. > The FAA has been cited as an example of regulatory capture, "in which the airline industry openly dictates to its regulators its governing rules, arranging for not only beneficial regulation, but placing key people to head these regulators." Which is an entirely different problem than a culture of "pulling up your bootstraps". https://en.wikipedia.org/wiki/Federal_Aviation_Administration https://en.wikipedia.org/wiki/Federal_Aviation_Administratio...
  - ineedasername 8y ago
    Yes, I have an example. The parent comment was about regulation in general, and mine was in response to that. However, there was the massive deregulation of the FAA in 1978 due to this sort of pressure. It had one effect of creating more competition in the industry, but it arguably went too far and has had an impact on safety as well. [0] [0] https://www.brookings.edu/opinions/perspective-on-airline-safety-deregulation-increases-risk/ https://www.brookings.edu/opinions/perspective-on-airline-sa...

jcims 8y ago

Unvetted image comparison of the cockpits 737 MAX 8 Cockpit - https://i2.wp.com/thepointsguy.com/wp-content/uploads/2017/06/IMG-Norwegian-Air-Boeing-737-MAX-8-cockpit.jpg https://i2.wp.com/thepointsguy.com/wp-content/uploads/2017/0... 737 800 Cockpit - https://i.imgur.com/eRULoST.jpg https://i.imgur.com/eRULoST.jpg I don't really know my way around an airliner but the key displays seem to be quite different and there's a lot fewer knobs on the MAX 8.

brozaman 8y ago
I don't know nearly enough to have a respectable opinion on this, but those screens can display different information configured to display different information at the user's choice. Here you have another max 8 with a completely different layout on those screens: http://www.driven-technologies.com/images/bt_portfolio/52/original/82d7d6b3d0dfab66726be2fc2f2a3833.jpeg http://www.driven-technologies.com/images/bt_portfolio/52/or...
- racingmars 8y ago
  That's a 787, not 737 at all...
VBprogrammer 8y ago
Most of those knobs below the glare shield are things like dimming the displays, setting what appears on each display (notable as there was an AIRS report from a pilot who struggled with the displays and presentation). But the key controls in these accidents are identical. Namely the electronic trim on the yoke, the trim wheels in the middle and the cut-off switches to the right and below the throttles.
deleted 8y ago
[deleted]
WalterBright 8y ago
Note the two black wheels on either side of the center console. These spin and make a loud clacking sound when the stabilizer trim is running. It should have been quite obvious that the trim action was what was causing the pitch down.

trt808 8y ago

So what's the most likely outcome for all the grounded planes at this point? As someone who has some fear of flying I'll definitely make sure none of my trips include a 737 max in the future, no matter how many patches or upgrades boeing releases

ceejayoz 8y ago
They'll be patched to take input from both angle-of-attack sensors (it has two, but the MCAS only used input from one of them) and limit how much the MCAS can override pilot input. I'd be more concerned by the regulatory capture that permitted this to happen than the specific model of aircraft.
mey 8y ago
It is very unlikely they will be scraped. There isn't just a handful out there, but more than 300. https://en.m.wikipedia.org/wiki/List_of_Boeing_737_MAX_orders_and_deliveries https://en.m.wikipedia.org/wiki/List_of_Boeing_737_MAX_order... My uninformed assumption is that once a suitable issue is isolated some sort of remediation (training/software/airframe/cockpit) all under the onset of various international gov bodies. No idea if the is a 1 year or 5 year process.
- sokoloff 8y ago
  I would expect them to be flying prior to the end of the year. The airplane has two AoA inputs and, between that and limiting the authority of the MCAS and adding an MCAS indicator on the panel, I suspect this is a short, mostly flight control software patch. ("Short" in aviation still might be 3 months.)
  - ceejayoz 8y ago
    They might be able to get away with requiring additional training in the meantime, as well. There are big PR risks in that approach, though.
kalleboo 8y ago
https://www.seattletimes.com/business/boeing-aerospace/failed-certification-faa-missed-safety-issues-in-the-737-max-system-implicated-in-the-lion-air-crash/ https://www.seattletimes.com/business/boeing-aerospace/faile... > According to a detailed FAA briefing to legislators, Boeing will change the MCAS software to give the system input from both angle-of-attack sensors. > It will also limit how much MCAS can move the horizontal tail in response to an erroneous signal. And when activated, the system will kick in only for one cycle, rather than multiple times. > Boeing also plans to update pilot training requirements and flight crew manuals to include MCAS. > These proposed changes mirror the critique made by the safety engineers in this story. They had spoken to The Seattle Times before the Ethiopian crash. > The FAA said it will mandate Boeing’s software fix in an airworthiness directive no later than April. After the fixes are implemented I wouldn't worry too much about it. Lots of planes have had terrible design flaws that were fixed. The pre-MAX 737 included.

chasely 8y ago

Is there a way to figure out where the 737Max is still being flown? I ask selfishly as I have a flight on Norwegian Air Argentina coming up and according to their seat map I appear to be on a 737 Max8, but there is no indication about the actual metal being flown for their flights, as far as I can tell. Norwegian suspended its use of the 737 Max8 for their main airline, but I haven’t seen anything about their use on their subsidiary airlines.

trimbo 8y ago
It is grounded worldwide
- chasely 8y ago
  So it is. Thanks.

cratermoon 8y ago

tl;dr: Boeing said, "trust us", FAA said, "OK cool, less work for us. Golf Friday?"

deleted 8y ago

[deleted]

danaliv 8y ago

These crashes are captivating, especially given how astonishingly safe air travel has been in the past decade or so. If I remember correctly 2017 was the safest year in the history of aviation. And airplanes, particularly modern jets, are fascinating no matter what they're doing. I remember twenty, thirty years ago looking out the towering floor-to-ceiling windows at the airport, marveling at how many different technological fields had to come together to make air travel possible: materials, energy, engineering, radio, logistics, physics, process control, weather prediction, mapping, software development—nowadays even spaceflight and the freakin' theory of relativity come into play where GPS is in use. As a budding geek it was (and still is) catnip. And then these two MAX jets go down within months of each other. Three hundred and forty six people killed. Three hundred and forty six families shattered, forever. When I think about them, I'm reminded that these weren't just malfunctions to be debugged in my terminal, these were three hundred and forty six tragedies that will ripple out to their friends, families, coworkers, and beyond, for decades to come. I wonder if we are being hasty in our speculation about the causes. I know we are all intensely curious—that intense curiosity is, I think, a defining feature of the community that frequents this site, and something a lot of us owe our successes to. I notice though a tendency for speculation to evolve into factual claims through repetition, and I wonder if we should be more careful not to allow repetition to take the place of evidence. Accident investigation is a slow process, and slow processes are frustrating. Information comes in a trickle. It's natural to want to piece together whatever details we have, wherever we can find them. In our hunger to find out what happened, how these 346 people lost their lives, let's not lose sight of the fact that the information we have right now is incomplete. Let's also not lose sight of the fact that we are talking about people. For the loved ones, this isn't an interesting puzzle; this is a gut-wrenching sorrow. I try to keep that at the center whenever someone asks me what I think about these crashes. I'm glad the MAX is grounded. And I'm intensely curious about what happened. I try to temper my thoughts on the matter according to the amount and quality of information I have, and the degree of knowledge and experience I've acquired. I don't always succeed. But I can at least rest easy knowing that the investigative team has access to a wealth of information and experience, and that they will make their data and findings public when their work is complete.

linuxftw 8y ago

Merrill 8y ago

How did Boeing decide to kill the 757 and to continually delay the "New Midsize Airplane", and to progressively extend and modify the 737 until it reached 757 size in the 737 MAX 9? I would bet good money that there is a wonderful book to be written about competing design teams, rival marketing plans, and mahogany row politics at Boeing about events resulting in the MAX kludge. Also: "An airline pilot reveals why a plane Boeing discarded 12 years ago is the one they desperately need" https://www.businessinsider.com/boeing-757-pilot-reveals-737-not-replacement-2016-11 https://www.businessinsider.com/boeing-757-pilot-reveals-737...

zymhan 8y ago
Because having a single "Type Rating" allows pilots to work 3 generations of 737 at a given time, meaning airlines don't need to train their pilots as much or hire new ones with the required type ratings.
masklinn 8y ago
> How did Boeing decide to kill the 757 and to continually delay the "New Midsize Airplane", and to progressively extend and modify the 737 until it reached 757 size in the 737 MAX 9? > Southwest Airlines has only operated Boeing 737 jetliner models, except for a period from 1979 to 1987 I expect that sort of things was part of the decision. Even more so as Boeing never really try to unify their offering and provide airbus-style CCQ[0][1] so there is a very strong incentive & pressure to update frames and keep them in the same rating to avoid crew retraining costs. [0] moving from an A320 to an A380 can take as little as 15 days, other moves are much shorter (down to 2 days CCQ for — I believe — moving between the A330 and the A340) [1] boeing does have some common type rating courses but only between a few pairs e.g. between the 757 and 767, or from the 777 to the 787

vpribish 8y ago

Since I keep seeing partially-informed comments about 737 pitch controls here's some notes and terms and links: It's not obvious, it's not simple, and other planes work in other ways - you can not just assume the 737MAX is like them. The 737 horizontal tail externally looks like 3 moving parts:front-to-back (and large to small) is: Stabilizer : Elevator : Balance Tab. see here: http://www.b737.org.uk/flightcontrols.htm#Pitch http://www.b737.org.uk/flightcontrols.htm#Pitch Stabilizer moves in response to trim - this is what we are mostly looking at. Elevator moves in response to the control column. Balance tab has several modes depending on flaps and hydraulic system health - but it mostly serves to offset aerodynamic force on the elevator in case the hydraulics fail and the elevator has to be controlled manually. (there is one other pitch control, I learned - the spoilers on the wing can give some help in landing in case the elevator controls fail.) There are many modes of operation and simple generalizations will not help.

starpilot 8y ago

EASA and other nations' aviation regulators are also on the hook for not validating this certification as thoroughly as they could have.

azernik 8y ago
Everyone trusted the FAA. So much for that.

Animats 8y ago

Well, now we know. Boeing has blown a reputation for quality they had for half a century. The Cormac C919 just got a big boost.

jussij 8y ago

The details provided by the article read rather badly for Boeing for several reasons. Firstly, I think the whole issue is not going away any time soon which is bad enough. But what looks worse is the article points to high levels of incompetence, if not gross negligence in the design and testing of the MCAS. Like all 737s, the MAX actually has two of the sensors, one on each side of the fuselage near the cockpit. But the MCAS was designed to take a reading from only one of them. Lemme said Boeing could have designed the system to compare the readings from the two vanes, which would have indicated if one of them was way off. Alternatively, the system could have been designed to check that the angle-of-attack reading was accurate while the plane was taxiing on the ground before takeoff, when the angle of attack should read zero. I can see this headed to the courts and if the details in the article are found to be correct, there's a good chance Boeing would be up for a rather big settlement, not to mention a massive dent to their reputation

dboreham 8y ago
I think the underlying problem is that a control system was designed with the assumption that its purpose was to make the pilot force feedback feel right, for regulatory compliance reasons. Therefore it was designed with low reliability requirements, presumably on the basis that if it doesn't work, no biggie because it's only there to make the controls feel right, and that only happens when the plane is about to stall, which never happens... Then...it turned out that when this control system malfunctions (which is can, quite often, due to aforementioned low reliability requirements), it will actually crash the plane. The lesson is probably: make sure that some system you're designing with low reliability characteristics (only uses one sensor, doesn't have redundant power supplies...) will fail with safe or benign outcomes.

cashsterling 8y ago

I am losing my mind over some of this (and trying to reserve some judgement because we don't have all of the facts yet). In the age where "engineers": (1) can automatically land a "VW bug sized" rover on Mars (2) can land booster rockets practically from orbit (3) can make an adaptive flight control system that can fly a drone even when half a wing is blown clean off mid-flight (on purpose). https://www.youtube.com/watch?time_continue=1&v=JyyN-qWWNfQ https://www.youtube.com/watch?time_continue=1&v=JyyN-qWWNfQ How does this MCAS system, as part of a larger flight dynamics system, have so little understanding of what the hell it is doing to the flight dynamics? I am beyond confused...

aidenn0 8y ago

For those curious about catastrophic vs. hazardous, the standard being used is DO-178B[1] 1: https://en.wikipedia.org/wiki/DO-178B https://en.wikipedia.org/wiki/DO-178B