4 ms·

He said the MCAS system met its "design and certification criteria". Yet a couple of paragraphs later, we read that "a report suggested that the system malfunct

by jfk13 8y ago

He said the MCAS system met its "design and certification criteria". Yet a couple of paragraphs later, we read that "a report suggested that the system malfunctioned, and forced the plane's nose down more than 20 times before it plummeted into the sea." Is that what it was designed and certified to do? Ouch.

peeters 8y ago
Basically the equivalent of a programmer saying "garbage in, garbage out". He's saying MCAS chews on the AoA sensor, and the AoA sensor was malfunctioning (therefore shifting the blame to the user, who is responsible for maintenance). But failing to mention that Boeing had a role to play in those links of the chain too, first in using only one of the AoA sensors and not having the disagree alert work, and two in that there's a rumor that it's a Boeing problem causing the AoA sensors to become damaged in the first place.
- jfk13 8y ago
  Also, isn't there something about the MCAS system originally being certified to make only a fairly limited adjustment to the trim, and subsequently being modified (without re-certifying) to make a much greater adjustment? So it was designed and certified to be able to nudge the nose down a certain amount. Then they changed it to be able to force the nose down much more severely. And it did. Without being an expert, it sure sounds like the Boeing "safety system" is at fault here...
  - fredthomsen 8y ago
    I read the same thing in an article but can't remember exactly where. Why manufacturers should be allowed to certify the safety of certain components of their own airplanes is beyond me.
    - cjbprime 8y ago
      I think the Seattle Times originally broke it: https://www.seattletimes.com/business/boeing-aerospace/failed-certification-faa-missed-safety-issues-in-the-737-max-system-implicated-in-the-lion-air-crash/ https://www.seattletimes.com/business/boeing-aerospace/faile... === After the Lion Air Flight 610 crash, Boeing for the first time provided to airlines details about MCAS. Boeing’s bulletin to the airlines stated that the limit of MCAS’s command was 2.5 degrees. That number was new to FAA engineers who had seen 0.6 degrees in the safety assessment. “The FAA believed the airplane was designed to the 0.6 limit, and that’s what the foreign regulatory authorities thought, too,” said an FAA engineer. “It makes a difference in your assessment of the hazard involved.”
hughes 8y ago
You really think they're saying it was designed and certified to plummet airplanes into the sea? If your design and certification criteria are insufficient, you can meet your design and certification criteria and still experience a failure.
- Someone1234 8y ago
  > You really think they're saying it was designed and certified to plummet airplanes into the sea? He's saying that's what Boeing said. I'm sure it isn't what they meant, but it is what they said.
jschwartzi 8y ago
If you read between the lines, he's basically saying that they did not have complete design and certification criteria for this feature of their aircraft and that that's ultimately at fault. In other words the MCAS met the design criteria established by the systems engineers, and the AoA sensor met the design criteria established by the systems engineers. And it passed all of the system-level testing established for the plane. It's just that the design criteria didn't include statements describing the AoA sensor data as being critical for the MCAS to function effectively. And as a result nobody analyzed the software design to determine whether a fault in the AoA sensor could cause the MCAS to perform in a state inconsistent with aerodynamics. And nobody who was working on the AoA readout was aware that the AoA sensor fault indicator would also indicate a problem with MCAS. What he's strongly implying is that this was a mistake on Boeing's part. However what he can't do is come out and say "I'm sorry guys. We fucked up. Our systems people failed to fully and properly account for this new system in the design criteria and as a result we failed to dedicate enough engineering resources to ensuring that faulty sensor inputs to this system couldn't result in a crash."
- cjbprime 8y ago
  This is why we have airworthiness certification, though. If you give full nosedown control authority to some system, that system needs to be redundant and have its failure probabilities modeled and accounted for, or the plane isn't fit to fly. Seems like the only way this "lack of criteria" can happen is when there's something very close to criminal negligence on Boeing's end and a regulator who either doesn't care or is being successfully lied to.
  - phire 8y ago
    And that was the second part of his statement, that the design was certified by the FAA at the time. Not sure if he is trying to push the blame onto the FAA or imply that the FAA agrees MCAS isn't at fault.
- atoav 8y ago
  To me this sounds a lot like everybody is trying to shift their responsibility around in the hope that it will just vanish. The thing is: if Boeing can’t precisely pinpoint the fault, how should anybody else? And if nobdy else can and Boeing won’t, why would you trust them as a customer?

by jfk13 8y ago

peeters 8y ago

Basically the equivalent of a programmer saying "garbage in, garbage out". He's saying MCAS chews on the AoA sensor, and the AoA sensor was malfunctioning (therefore shifting the blame to the user, who is responsible for maintenance). But failing to mention that Boeing had a role to play in those links of the chain too, first in using only one of the AoA sensors and not having the disagree alert work, and two in that there's a rumor that it's a Boeing problem causing the AoA sensors to become damaged in the first place.

jfk13 8y ago
Also, isn't there something about the MCAS system originally being certified to make only a fairly limited adjustment to the trim, and subsequently being modified (without re-certifying) to make a much greater adjustment? So it was designed and certified to be able to nudge the nose down a certain amount. Then they changed it to be able to force the nose down much more severely. And it did. Without being an expert, it sure sounds like the Boeing "safety system" is at fault here...
- fredthomsen 8y ago
  I read the same thing in an article but can't remember exactly where. Why manufacturers should be allowed to certify the safety of certain components of their own airplanes is beyond me.
  - cjbprime 8y ago
    I think the Seattle Times originally broke it: https://www.seattletimes.com/business/boeing-aerospace/failed-certification-faa-missed-safety-issues-in-the-737-max-system-implicated-in-the-lion-air-crash/ https://www.seattletimes.com/business/boeing-aerospace/faile... === After the Lion Air Flight 610 crash, Boeing for the first time provided to airlines details about MCAS. Boeing’s bulletin to the airlines stated that the limit of MCAS’s command was 2.5 degrees. That number was new to FAA engineers who had seen 0.6 degrees in the safety assessment. “The FAA believed the airplane was designed to the 0.6 limit, and that’s what the foreign regulatory authorities thought, too,” said an FAA engineer. “It makes a difference in your assessment of the hazard involved.”

hughes 8y ago

You really think they're saying it was designed and certified to plummet airplanes into the sea? If your design and certification criteria are insufficient, you can meet your design and certification criteria and still experience a failure.

Someone1234 8y ago
> You really think they're saying it was designed and certified to plummet airplanes into the sea? He's saying that's what Boeing said. I'm sure it isn't what they meant, but it is what they said.

jschwartzi 8y ago

If you read between the lines, he's basically saying that they did not have complete design and certification criteria for this feature of their aircraft and that that's ultimately at fault. In other words the MCAS met the design criteria established by the systems engineers, and the AoA sensor met the design criteria established by the systems engineers. And it passed all of the system-level testing established for the plane. It's just that the design criteria didn't include statements describing the AoA sensor data as being critical for the MCAS to function effectively. And as a result nobody analyzed the software design to determine whether a fault in the AoA sensor could cause the MCAS to perform in a state inconsistent with aerodynamics. And nobody who was working on the AoA readout was aware that the AoA sensor fault indicator would also indicate a problem with MCAS. What he's strongly implying is that this was a mistake on Boeing's part. However what he can't do is come out and say "I'm sorry guys. We fucked up. Our systems people failed to fully and properly account for this new system in the design criteria and as a result we failed to dedicate enough engineering resources to ensuring that faulty sensor inputs to this system couldn't result in a crash."

cjbprime 8y ago
This is why we have airworthiness certification, though. If you give full nosedown control authority to some system, that system needs to be redundant and have its failure probabilities modeled and accounted for, or the plane isn't fit to fly. Seems like the only way this "lack of criteria" can happen is when there's something very close to criminal negligence on Boeing's end and a regulator who either doesn't care or is being successfully lied to.
- phire 8y ago
  And that was the second part of his statement, that the design was certified by the FAA at the time. Not sure if he is trying to push the blame onto the FAA or imply that the FAA agrees MCAS isn't at fault.
atoav 8y ago
To me this sounds a lot like everybody is trying to shift their responsibility around in the hope that it will just vanish. The thing is: if Boeing can’t precisely pinpoint the fault, how should anybody else? And if nobdy else can and Boeing won’t, why would you trust them as a customer?