5 ms·

Here's a version of how it occured; "Instead, engineers were able to add just a few inches to the front landing gear and shift the engines farther forward on t

Here's a version of how it occured; "Instead, engineers were able to add just a few inches to the front landing gear and shift the engines farther forward on the wing. The engines fit, but the Max sat at a slightly uneven angle when parked. While that design solved one problem, it created another. The larger size and new location of the engines gave the Max the tendency to tilt up during certain flight maneuvers, potentially to a dangerous angle. To compensate, Boeing engineers created the automated anti-stall system, called MCAS, that pushed the jet’s nose down if it was lifting too high. The software was intended to operate in the background so that the Max flew just like its predecessor. Boeing didn’t mention the system in its training materials for the Max. Boeing also designed the system to rely on a single sensor — a rarity in aviation, where redundancy is common. Several former Boeing engineers who were not directly involved in the system’s design said their colleagues most likely opted for such an approach since relying on two sensors could still create issues. If one of two sensors malfunctioned, the system could struggle to know which was right. Airbus addressed this potential problem on some of its planes by installing three or more such sensors. Former Max engineers, including one who worked on the sensors, said adding a third sensor to the Max was a nonstarter. Previous 737s, they said, had used two and managers wanted to limit changes." https://www.nytimes.com/2019/04/08/business/boeing-737-max-.html https://www.nytimes.com/2019/04/08/business/boeing-737-max-....

breakingcups 8y ago
"Several former Boeing engineers who were not directly involved in the system’s design said their colleagues most likely opted for such an approach since relying on two sensors could still create issues. If one of two sensors malfunctioned, the system could struggle to know which was right." Shouldn't this have been more of a red flag not to rely on a single sensor when human lives are literally at stake?
- phire 8y ago
  I suspect their reasoning was: It only trims down by 0.6°, what does it matter if a faulty sensor accdentally activates it. The plane is still flyable slightly out of trim and the pilots can easily correct it. The 0.6° number was what they said immediately after the Lion Air crash. But their reasoning was wrong. Turns out, MCAS was actually adjusting trim down by more like 1.5° and they never considered that a faulty sensor would trigger multiple MCAS activations and move the stablizer all the way to the end of it's range.
Datenstrom 8y ago
> Boeing also designed the system to rely on a single sensor — a rarity in aviation, where redundancy is common. I worked on the C-2 Greyhound aircraft in a past life. Part of an upgrade they got, only because it was an absolute requirement to fly in European airspace, was a magnetometer. The documentation on replacing and testing the new sensor, of which there was only one, was non-existent. The documentation said that the sensor could not and would never fail. While in another country one failed. In disbelief my Chief had me read out every wire in the system even though I knew it was the sensor immediately. The bird was down for weeks until we got a new one because supply didn't exist and I had to make up a suitable plan for testing the replacement on the fly. I wonder what kind of practices lead to a "this system can never fail" mentality. It should be assumed everything can and will fail.
- teraflop 8y ago
  This is the second time I've had occasion to post this quote here in the last week: "The major difference between a thing that might go wrong and a thing that cannot possibly go wrong is that when a thing that cannot possibly go wrong goes wrong it usually turns out to be impossible to get at and repair." -- Douglas Adams
- inflatableDodo 8y ago
  >It should be assumed everything can and will fail. And anything still seemingly working to spec over a fairly conservative cycle count has already failed. Just in ingenious ways that it hasn't yet informed you of and nobody has yet discovered. You should probably swap it out for a spare and take it apart and hit it with things till you are sure. You should probably do that now while there is still time.
05 8y ago
MCAS is not an anti-stall system, it’s a way to change stick forces by trimming the horizontal stabilizer - the surface with most control authority. There’s no evidence it has ever prevented a single stall or even activated properly, but there’s evidence it has helped crash two planes.

breakingcups 8y ago

"Several former Boeing engineers who were not directly involved in the system’s design said their colleagues most likely opted for such an approach since relying on two sensors could still create issues. If one of two sensors malfunctioned, the system could struggle to know which was right." Shouldn't this have been more of a red flag not to rely on a single sensor when human lives are literally at stake?

phire 8y ago
I suspect their reasoning was: It only trims down by 0.6°, what does it matter if a faulty sensor accdentally activates it. The plane is still flyable slightly out of trim and the pilots can easily correct it. The 0.6° number was what they said immediately after the Lion Air crash. But their reasoning was wrong. Turns out, MCAS was actually adjusting trim down by more like 1.5° and they never considered that a faulty sensor would trigger multiple MCAS activations and move the stablizer all the way to the end of it's range.

Datenstrom 8y ago

> Boeing also designed the system to rely on a single sensor — a rarity in aviation, where redundancy is common. I worked on the C-2 Greyhound aircraft in a past life. Part of an upgrade they got, only because it was an absolute requirement to fly in European airspace, was a magnetometer. The documentation on replacing and testing the new sensor, of which there was only one, was non-existent. The documentation said that the sensor could not and would never fail. While in another country one failed. In disbelief my Chief had me read out every wire in the system even though I knew it was the sensor immediately. The bird was down for weeks until we got a new one because supply didn't exist and I had to make up a suitable plan for testing the replacement on the fly. I wonder what kind of practices lead to a "this system can never fail" mentality. It should be assumed everything can and will fail.

teraflop 8y ago
This is the second time I've had occasion to post this quote here in the last week: "The major difference between a thing that might go wrong and a thing that cannot possibly go wrong is that when a thing that cannot possibly go wrong goes wrong it usually turns out to be impossible to get at and repair." -- Douglas Adams
inflatableDodo 8y ago
>It should be assumed everything can and will fail. And anything still seemingly working to spec over a fairly conservative cycle count has already failed. Just in ingenious ways that it hasn't yet informed you of and nobody has yet discovered. You should probably swap it out for a spare and take it apart and hit it with things till you are sure. You should probably do that now while there is still time.

05 8y ago

MCAS is not an anti-stall system, it’s a way to change stick forces by trimming the horizontal stabilizer - the surface with most control authority. There’s no evidence it has ever prevented a single stall or even activated properly, but there’s evidence it has helped crash two planes.