21 ms·

Boeing Built Deadly Assumptions into 737 Max, Blind to a Late Design Change

• aivisol 7y ago
  Is this only me, or all this one-vs-two AoA sensor talk seems some kind of diversion from the real problem with this plane. I mean, if one-sensor based MCAS failed twice so early in the life span of the plane model, what is the probability that a two-sensor model will fail pretty soon as well? The math should be simple, we have all data needed: combined hours flown by all planes of the type and number of failures (at least two known, which can help us to estimate a MTBF of the sensor).
  • Aloha 7y ago
    The AOA sensors are effectively a consumable, and would undergo regular replacement over the life of the aircraft, the odds of BOTH of them failing at the same moment in the same flight is very very small.
    • aivisol 7y ago
      Ok, that makes sense. But are the hours at which they got replaced are on order (or several) of magnitude lower than a two-sensor failure can occur? I hope it is calculated.
      • CydeWeys 7y ago
        The point is that, as safety-critical equipment, you can't fly the plane if one is broken. So you'd need to have two fail within a single flight, and fail in the same way, in order to cause an incorrect activation of MCAS. With just one sensor, it's much more likely. Note that Airbus uses three of these sensors on their planes, so that when one fails you know which one it is, and can still rely on the signals from the two remaining good ones. Then you replace the failed sensor before the next flight.
        • aivisol 7y ago
          That was my original question. What is the probability of them failing at the same flight in the same way (say they got frozen at the same angle, hit by blizzard, etc, etc). Intuition is that the chances are high given their low MTBF.
          • deleted 7y ago
            [deleted]
        • konspence 7y ago
          This works until two sensors fail in the same direction: >The aircraft's computers received conflicting information from the three angle of attack sensors. The aircraft computer system’s programming logic had been designed to reject one sensor value if it deviated significantly from the other two sensor values. In this specific case, this programming logic led to the rejection of the correct value from the one operative angle of attack sensor, and to the acceptance of the two consistent, but wrong, values from the two inoperative angle of attack sensors. This resulted in the system's stall protection functions responding incorrectly to the stall, making the situation worse, instead of better. https://en.m.wikipedia.org/wiki/XL_Airways_Germany_Flight_888T https://en.m.wikipedia.org/wiki/XL_Airways_Germany_Flight_88...
    • rightbyte 7y ago
      If they are replaced simultaneously the chance of them simultaneously not working the next take off is non negligible.
  • mikeash 7y ago
    The problem isn’t failure, but detecting failure. If the sensor had just stopped responding, there wouldn’t have been any problem. The planes would keep flying, the sensors would get replaced, and everyone would be fine. What happened was that the sensor gave erroneous readings. The MCAS system reacted to those erroneous reading and crashes the plane. With two sensors, you can detect failure. It’s very unlikely that both would fail simultaneously. If they did, it’s very unlikely that both would provide the same erroneous readings.
    • codedokode 7y ago
      It is not unlikely, I don't remember details, but I remember the case when two broken sensors voted over working sensor. The problem is that in order to save tiny amount of money Boing made plane rely on unreliable sensors.
      • BonesJustice 7y ago
        Assuming that’s true, the fact that it has happened before does not mean simultaneous failure is not incredibly unlikely. Unlikely things do happen. One might call it extraordinarily bad luck.
      • mikeash 7y ago
        It’s not unlikely... because of some vague memory you have?
        • fhars 7y ago
          It's not unlikely because it happened repeatedly: https://www.pprune.org/rumours-news/558483-iced-aoa-sensors-send-a321-into-deep-dive.html https://www.pprune.org/rumours-news/558483-iced-aoa-sensors-... http://avherald.com/h?article=410c9cec/0015 http://avherald.com/h?article=410c9cec/0015
      • bonzini 7y ago
        Maybe you're thinking of QF72 where erroneous data was "too wrong" to be smoothed out by the computer?
  • lisper 7y ago
    > what is the probability that a two-sensor model will fail pretty soon as well It's actually higher than the probability that a one-sensor version will fail. With two sensors, you have an effective failure if either sensor fails, and the probability of that happening is roughly twice the probability that a single sensor will fail (assuming failures are independent, which is not necessarily a valid assumption). However, with two sensors you can tell when one has failed (even though you may not know which one it was) and so the consequences of the failure might be less severe. The problem is: now pilots need to be prepared to fly the plane with a failure sensor, which is to say, without MCAS. To do that, they will need additional training. Avoiding that was the whole point of MCAS in the first place. That's the reason it's taking so long to sort this out. Technically, it's an easy problem to solve. It's the economics that are daunting.
  • xvf22 7y ago
    If MCAS is disabled for some reason because of sensor failure, how does that factor into the common type rating? Same goes for if they significantly lower how much input it provides.
  • gnarlysasquatch 7y ago
    Not necessarily a diversion, but certainly not the only cause in a proper failure analysis.
  • piadodjanho 7y ago
    I have the impression that people are overlooking the sensors. They are suppose to be very, very, reliable. Two different planes got wrong reading from sensor in the same side, this seems to be a red flag for me. I wonder in what side of the sensor cable the problem is.
    • tlb 7y ago
      They’re not expected to be that reliable. They’re small vanes sticking out the side of the nose, vulnerable to bird strikes. The article mentions hundreds of reported failures over the years. The way to make the system reliable is redundancy.
      • piadodjanho 7y ago
        The article says it had 122 failure due bird strikes plus 85 unnamed problems in about 30 years of data. Considering the number of flights, that does sounds reliable to me. I still think two failures in the same sensor, in the same airplane, under the same condition, in less than one year did not happen by chance.
        • chimpburger 7y ago
          You have a very poor understanding of probability. At a mean failure rate of 0.66 per year, it is quite probable for 2 failures to be spaced 4.5 months apart.
  • 2Ccltvcm 7y ago
    I want to know why the Boeing flight computer needs pitot tube input at all. Modern ublox GPSes can easily obtain 3D lock on multiple satellite constellations within a minute of booting. Several of these in parallel for redundancy if you are paranoid. Flight controllers on fixed wings don't even need a magnetometer to stabilize. Just GPS path heading. If all else fails, solid state accelerometers are very reliable. Accelerometer only based dead reckoning works great. If all else fails, a single accelerometer should be sufficient to get the plane relatively stable. A barometer can help too, but doesn't seem necessary. These systems can be easily combined with fallback logic to keep the plane in the sky. I just don't understand what is so hard about this for Boeing. I understand airspeed is not the same as ground speed, but this should provide enough information to the flight computer to keep the plane in the air or at least stable.
    • mnw21cam 7y ago
      If all you are using is ground-based position/speed, then you are ignoring the very real possibility that the air you are flying through is not stationary relative to the ground. In actual fact, especially at high altitudes, the air can be moving very fast, and the difference between ground speed and airspeed can be the difference between flying and stalling. Also, your GPS measurements give you position, direction, and speed, but they don't give you orientation. You would have to have another instrument to feed that into the system (such systems exist). But yes, it would be a sanity check.
      • 2Ccltvcm 7y ago
        Can a near-stall condition be detected solely with some combination of GPS, accelerometer, and barometer?
        • mgsouth 7y ago
          [Disclaimer: not an aeronautical enginner or pilot.] Unfortunately, no. Stalling is a function of the wing's _angle_ relative to the flow of air, not of speed. If the angle is too sharp the air can't follow the curve of the wing. The critical angle is (pretty much) independent of speed. For example: if you stick your hand out of the window of a car traveling at 60 MPH, and hold it almost flat to the wind (say 80 deg.), then the air can't follow down the back of your hand. All of the "push" is backwards, and there's no push up. If you hold it at 30 deg. then the air flows around your hand, which deflects the air down and your hand up, very strongly. Even if you're only traveling at 5 MPH, if you hold your hand at 30 deg. the air will flow around your hand and deflect it upward; it will just be a very weak effect. The angle between the wing and the air flow is what is called the "angle of attack", and what the AoA sensors measure. The only other instrument that comes close is the Attitude gauge (the globe thing). However, it measures the plane's angle relative to the horizon, and air moving relative to the plane usually isn't parallel to the ground in conditions where the AoA matters. Wikipedia article, with much detail, pictures, etc.: https://en.m.wikipedia.org/wiki/Angle_of_attack https://en.m.wikipedia.org/wiki/Angle_of_attack
• runciblespoon 7y ago
  “After Boeing removed one of the sensors from an automated flight system on its 737 Max, the jet’s designers and regulators still proceeded as if there would be two.” No, no, no. This is just more of shifting the blame from Boeing upper management. They couldn't use two Angle of Attack (AOA) sensors as when there was a differing reading there would be no way to know the correct reading, which is why MCAS used a single AOA sensor on the right-hand side.
  • empath75 7y ago
    This doesn’t seem correct to me, but I can’t put my finger on why. Surely if both agree that’s more certainty than a single sensor reading. Granted a disagreement would be bad, but at least you would have some warning that one of them is wrong, whereas you would have none at all if relying on a single sensor.
    • kejaed 7y ago
      You wouldn’t be able to know which one was wrong but you’d be able to know and annunciate an AOA MISCOMPARE (which was an option on the Max) and then disable MCAS.
      • weaksauce 7y ago
        Which was not an option to upper management because that would cause training for the event of disengagement and a new type rating.
    • fhars 7y ago
      It doesn't seem correct to you because they might have been trying to be sarcastic. Using two sensors would admit that they might disagree, and that there might be situations where the MCAS could not work. But there cannot be a situation where the MACS doesn't work if the MAX shall have the same type rating as previous 737s, so the sensors cannot disagree, and so it would be useless and wasteful to use two sensors. Issuing that disagreement warning would completely undermine the very reason for the existence of the MCAS.
  • 7y ago
• kejaed 7y ago
  I really see this as a failure of the Systems Engineering process. With so many people unaware of the impacts of the changes, it’s up to the systems types to have the big picture view and make sure these sorts of things are taken into account. Especially if as the article says a failure of the AOA sensor on the system would be Hazardous (looks like it was Catastrophic when paired with MCAS in retrospect), that would have made the functional Design Assurance level for this system DAL B, which adds enough rigour not only in the software development process but so much before you even get to that in terms of Safety Assessments and ESPECIALLY change impact analyses when the function changes. For sure there may have been pressure from management to keep MCAS out of the manual but it’s not really up to he regulatory agency to be experts on the aircraft design, if things are being hidden by the company then I’d consider this bordering on professional misconduct on the parts of the engineers overseeing this work. I say this as a Professional Engineer working as an aerospace systems engineer.
  • kejaed 7y ago
    Thinking about this a little more, I also see a failure here in terms of naming things, which I have noticed in my career can be scoffed at but is so important. As the article says, the function of MCAS changed and its operational envelope was greatly expanded. What if, internally at least, the new system was referred to as MCAS2? This is somewhere that things can get political, as was exactly the case with the Max, where they did not want anything to be considered a change to the aircraft type, let alone knowing the MCAS system existed in two majorly differing versions.
    • countbackula 7y ago
      Admittedly I have 0 familiarity of the internals of a corporate electrical engineering environment, but this is a logically sound idea that in many other industries is standard. OS 10.02, Apache license v. 2, Archer router xyz Rev 02. What's the limiting factor here in the case of MCAS?
      • karmelapple 7y ago
        There are definitely different versions of software, each with unique identifiers, such as typical version numbers. There’s also the idea of “flight test ready” software, which is able to go onto a flight, vs software that is only to be used in a lab that is not truly flying in the air and controlling the plane.
• tus87 7y ago
  > a fundamental overhaul to an automated system that would ultimately play a role in two crashes Are they STILL blaming the computer instead of the unstable air-frame after the engines were moved?
  • Pxtl 7y ago
    Because they can fix the computer and the sensors but if they have to toss out the whole airframe they're going to be out billions.
  • Obi_Juan_Kenobi 7y ago
    The redesign did not make the aircraft unstable. I don't know how this became such a meme, but it's trivial to see that it's not true. Commercial passenger aircraft must be aerodynamically stable by FAA regulation: https://www.ecfr.gov/cgi-bin/text-idx?node=14:1.0.1.3.11#se14.1.25_1171 https://www.ecfr.gov/cgi-bin/text-idx?node=14:1.0.1.3.11#se1... The engine change really wasn't a big deal. The net effect is "flight stick feels lighter at high AoA with high thrust." That's it. My understanding is that the 737-MAX flys more like a 757 in this regard. Nothing crazy, just a difference. Now, that's enough to require re-certification by FAA standards, because it's enough of a difference that it could cause problems of pilot error. But going on like the aircraft wants to fall out of the sky isn't helping anyone here. MCAS was intended to be a small tweak that avoids the re-cert. And it would have been fine if they had neutered the system such that it couldn't input such extreme trim angles, or else has more reliability as needed in a system that could have such dramatic effects when malfunctioning.
    • salawat 7y ago
      The meme comes from the fact that according to the technical definition of aerodynamic stability, the MAX has pitch instability at high AoA. FAA certification regulations appear to be willing to accept minor deviance in regard to them so long as they can be convinced there are sufficient technological controls in place to manage the instability. This is the danger of self-certification by the way. The company signs off that everything is fine, and the regulator is blissfully unaware they've been rused until after people have already died.
• throw7 7y ago
  "As part of the fix, Boeing has reworked MCAS to more closely resemble the first version." Be very wary if pilot training is not part of the "fix" to getting the Max back up in the air. If MCAS is being "rolled back" then certain situations such as "The Max wasn’t handling well when nearing stalls at low speeds." come back.
  • oldjokes 7y ago
    Anything short of admitting "we fundamentally screwed up, and are rethinking the poor decision to pair this engine with this airframe" as well as "we are reviewing all our design processes and how the FAA oversees every step of the process" is unacceptable. MCAS is just the horrific bloody bandage that is peeling away, it's not actually the problem here. This probably won't happen of course, all they seem to want to do is fix as little as possible as quickly as possible while denying they ever knew anything. If I were someone powerful like a pilot union leader I would start throwing conniption fits in public and refuse to let my people fly on Max's at all.
    • CamperBob2 7y ago
      Anything short of admitting "we fundamentally screwed up, and are rethinking the poor decision to pair this engine with this airframe" Can you cite the basis for this often-expressed sentiment? There's absolutely no reason why a properly-designed and -vetted MCAS system wouldn't have been a perfectly acceptable solution to any handling irregularities caused by the engine configuration. The idea was fine. The fault was 100% in the implementation. And no, downvotes are not a valid citation.
      • tacosx 7y ago
        It's not impossible to make it work, and in the future I'd expect more and more automated systems in planes for sure. But you have to recognize the whole engine hack is just a convoluted workaround to avoid as much pilot training as possible. The entire goal of the project seems to be to avoid ever training pilots for as long as possible. It's a brand new plane, the newest plane on the market, and the first thing you need to do to take off is turn off the cabin air conditioning. Why? Because that's what we had to do 50 years ago in the first 737. God forbid this plane startup any way besides turning off the cabin air conditioning. If we changed that, we'd have to... gasp retrain pilots!
• csours 7y ago
  I'm surprised no one has mentioned Therac 25 or Normal Accidents yet. For reference, the Therac 25 was a computer-controlled radiation therapy machine involved in several over-exposures due to replacement of physical controls with computer based ones without complete understanding of the interactions of the controls. The Max feels very much like that. No one can really keep a whole aircraft in their head, much less a whole aircraft development project. We use computers for that, as well as mental heuristics. But if those computers and brains are not fed all the proper data and connections, they will not find the all the problems. Additionally, there seems to be a lot of the tail wagging the dog. If this system is expected to perform according to X specifications, then by golly it will, and we will show that it does. https://en.wikipedia.org/wiki/Therac-25 https://en.wikipedia.org/wiki/Therac-25 Edit: Please don't take the above as absolution of Boeing. Someone (a lot of someones) really should have known better.
  • mehrdadn 7y ago
    I don't see these as equivalent, at least not based on what I've learned about the cases (feel free to correct). As I understand, Therac-25 was due to software bug and a genuine design process inadequacy that allowed it to cause a problem, that could happen with people acting entirely in good faith, simply because they didn't know better. That's why they created standards to address the design process. With 737MAX... pretty much literally everyone could tell you the decisions were bad, and so many seem to have been made in bad faith, specifically to e.g. avoid recertification and increase revenues in a pretty reckless manner.
    • csours 7y ago
      It's not the equivalent, but it is the consequence of a chain of incremental changes, each of which is not sufficient to subvert safety margins, but together they change the paradigm. As to bad faith, yes, I'm sure there was some of that, but generally decisions like these don't look like bad faith to the people making them. It's easy to get swamped by technical details.
      • mehrdadn 7y ago
• cmurf 7y ago
  Boeing engineers did consider [MCAS activation due to failed sensor] in their safety analysis of the original MCAS. They classified the event as “hazardous,” ... could trigger erroneously less often than once in 10 million flight hours. The incuriosity of all parties to an event categorized as hazardous is astonishing. Boeing says it's a system that's completely transparent to the pilot, and therefore there is no need to describe a failure that they say would be hazardous. What part of that passes a reasonable smell test? It's safe unless it fails, which would be rare, but if it fails people could die? But meh, it's rare so let's not even find out what would happen if it happened? Boeing must be compelled to show their work for this probability computation, because it is clearly wrong. And both Boeing and the FAA have to answer why there's no mandatory testing of hazardous events. At least what does a simulator think will happen in various states of perturbed sensor data, and how does a pilot react when not expecting such an event? Oh, and the part about depending on a single sensor is not, per Boeing, a single point of failure because human pilots are part of the system? That's a gem. The pilots are the backup? This poisonous form of logic is perverse.
  • jaggirs 7y ago
    If the pilots had recieved training, then they could be a backup. So probably whoever did that safety analysis was assuming pilots would know how and when to turn off the system, but the pilots in fact didn't know this system existed at all.
    • bumby 7y ago
      Administrative mitigation like pilots are usually the least preferential ways of mitigating hazards. Humans are often the least consistent, most fallible part of a system. If there were engineering solutions available I would hope Boeing would implement them.
      • jplayer01 7y ago
        There are many examples of automated systems not accounting for novel or rare situations that the original designers didn't plan for or ignored. This is why manual override should always be available as a last resort if possible. No automated system we can design today is perfect. While protections and automatic mitigation should be implemented, taking away agency from pilots or whoever else is a recipe for disaster.
• ficklepickle 7y ago
  This whole plane sounds like any ugly hack. They slapped very different engines on an existing airframe. Then, when it inevitability exhibited undesirable behaviour, they tried to paper over the cracks. Then they hid this information from their customers, regulatory agencies and the pilots. It makes me wonder if there are other issues with the Max that the public doesn't know about yet. I hope a thorough review of Boeing's internal communications is already underway. If there is proof that these decisions were made for financial gain, they should face criminal charges. IMO, whether it was greed or just general incompetence, Boeing has demonstrated that they are not responsible enough to self-certify their aircraft.
  • Causality1 7y ago
    Indeed. The article makes it sound like a foul-up late in the design process, but this plane was corrupt from the very beginning when Boeing set out to dodge the requirement for re-certifying the airframe.
    • K0balt 7y ago
      To be fair, it's not like this isn't standard industry practice. Airframe evolve and change, with incremental changes typically only affecting limited areas of impact. OTOH seeking a non aerodynamic solution to a significant stability degrading airframe modification was IMHO a bridge too far. If the pitch stability (not the pitch feel) problems couldn't be dealt with aerodymancally without busting type certification, than perhaps the whole concept was just too much of a stretch for the venerable old 737. It surprises me, though, that this couldn't have been engineered out with enhancements to the horizontal stabilizer, such as tip fences or a span increase to offset the lift from the engine nacelles. If it could have, but software was cheaper, then that's even a darker indictment of Boeing's engineering incompetence.
      • inferiorhuman 7y ago
        If you make the plane wider you run into issues finding room for it at the gates.
• acje 7y ago
  This was premature automation caused by not fully understanding the context. Results in less friction at the cost of enabling a black swan. Bad trade off. The Viking Sky cruise ship that was 1 minute away from releasing its damage potential of about 1300 people. 4 engines stoped simultaneously to protect them selves. Risking the entire ship in one of Norway’s most dangerous waters during harsh weather. There are so many similar examples. Tank turrets self protecting and killing soldier during peace time. Automatic gearbox on military vehicle self protecting against overheating although vehicle is under enemy fire, but the sensor can’t know that.. we need to rethink how “security automation” should work. How do you know if an override is relevant? How to train the operator?
  • acje 7y ago
    It’s like these examples of security automation are designed to have the exact opposite effect as chaos engineering.
• danols 7y ago
  The day someone very high up the corporate ladder truly gets held responsible for this type of greed & negligence and will be put a way for a long prison sentence would be a good day for society. But I am not holding my breath... But I hope that the CEO Dennis Muilenburg deep down understands he seriously fuxxed up real bad and every now and then is having a hard time falling a sleep in his $10M mansion knowing that he is ultimately responsible for hundreds of peoples unnecessary deaths due to his failed values as a leader.
  • ilaksh 7y ago
    I agree. I think the FAA failed in it's mission also.
    • danols 7y ago
      Their credibility outside the US is shattered. Their word & opinion caries zero weight anymore since they have proven themselves to be morally corrupt.
      • ulfw 7y ago
        They have outsourced certification (their job!) to the manufacturer (Boeing) since the 787. My confidence in that plane thus isn’t sky high either.
    • nopzor 7y ago
      it’s reputation has been destroyed in the international aviation community. which is extremely sad because it was really hard won. classic story of gutting a gov organization, and regulatory capture. i know some really good people at faa and the situ makes their blood boil. mine too.
      • jquery 7y ago
        I haven't seen commentary from international pilots who are worried about flying Boeing planes. Even with the two MAX planes that went down, fatal crashes are enormously rare (for Airbus/Boeing/CRJs/ERJs). This one is only getting so much attention because it was that extraordinarily rare "design defect" rather than a maintenance issue or pilot issue.
• basicplus2 7y ago
  All this talk about how mcas was not designed properly or how it could be prevented from failing is eroneous. Good safe airplane design is about a neutral flying design without the need for complex systems. This plane is fundamentally flawed because the engines are in the wrong position because the landing gear is two short to fit them in the correct position. The test pilot was clear about very poor flying characteristics at slow flyong speeds requiring mcas to be more aggressive. This plane should not be flying with this engine configuration as it fails the most fundamental principal of good aeroplane design of neutral handling.
  • cmurf 7y ago
    FTA: The Max wasn’t handling well when nearing stalls at low speeds. In a meeting at Boeing Field in Seattle, Mr. Wilson told engineers that the issue would need to be fixed. He and his co-pilot proposed MCAS, the person said. It is not clear this translates into a fundamentally flawed design. It's a serious assertion, even though at the same time it's vague. Why did it need to be fixed? To avoid pilot training? Or to pass a FAR 25 airworthiness certification requirement? We can't tell from this reporting. Months after these accidents, people are still asking this question. The difference matters. I'm very skeptical that software can legally be used to paper over aerodynamic flaws, as I read FAR 25. In fact, neutral design is not adequate, it must exhibit positive static and dynamic stability in all three axes. Fly by wire software doesn't make a plane with negative stability behave as if it has positive stability, the software provides various safeguards in a layered manner.
• KaoruAoiShiho 7y ago
  How would you design your bureaucracy so that this kind of thing can't happen? I see this type of failure all the time in organizations big and small. Sometimes things are just too complex to have an auteur that can understand the entire system and when every department strives to optimize for its specific goal shit can really hit the fan.
  • keiru 7y ago
    Eventually, artificial intelligence. Maybe not in the near future, but as technology progresses and every manufacturer strives to optimize their designs with the latest features, it will become an unsourmountable task to oversee every aspect of it (efficiently). I'm not talking about actively designing, but rather for warning/flagging for potential error. In very complex enterprises like global transport or building skyscrappers there is a lot to learn from experience and little human time, but it might be very cost-efective to train all-observing self-learning AI to look over everyone's shoulder, and warn you about using the right type of bolts, or how the coming heavy rains in Guatemala might affect your supply chain. It's not that far-fetched when you realize it doesn't need to really understand anything, just be very good at playing word association and micromanaging.
    • csours 7y ago
      AI is only as good as its training data and goals/success conditions.
      • keiru 7y ago
        Yes, AI is designed in very particular situations to fit ver specific tasks. I never meant there to be a single mind controlling the whole world. Today you could program an assisting AI that told you when "you missed a spot" when painting your house. It's simply not cost effective. But eventually driving and medical diagnosis AI, while imperfect, will have a better success rate that humans. Do you really think that won't apply to industrial production eventually, say in a hundred years?
    • perl4ever 7y ago
• soundpuppy 7y ago
  Airplanes have become next to impossible to maintain, mostly software related, yet at the same time seem to be increasingly available to only the rich. Oh what a tragedy. And if you don't believe me, why are we doing this passport only to certain individuals I heard of?
  • sokoloff 7y ago
    > at the same time seem to be increasingly available to only the rich I believe that airfares have never been cheaper than in the last decade. In 1965, only 20% of Americans had ever flown in a plane. By 2000, 50% of Americans took at least one round-trip flight per year (with an average of 2 per year). Airfares are down by 50% in 30 years. https://www.theatlantic.com/business/archive/2013/02/how-airline-ticket-prices-fell-50-in-30-years-and-why-nobody-noticed/273506/ https://www.theatlantic.com/business/archive/2013/02/how-air...
• tuna-piano 7y ago
  How MCAS slipped through certification process was not the main issue (mistakes in complex products can happen). The main issue was Boeing not caring that MCAS was dangerous even after discovering it. After the Lion Air crash, it was very apparent to Boeing that MCAS was not safe. This whole article focuses on how MCAS slipped through development+certification - but really even after Boeing new the dangers of MCAS, the MAX still was allowed to fly. It was hidden and dangerous. Then it was open and dangerous but was still defended by Boeing. Damning.
  • dhimes 7y ago
    How MCAS slipped through certification process was not the main issue I think it's a huge issue, but perhaps not criminal. The hiding/lying/etc is a criminal issue in my view.
• kdazzle 7y ago
  > It never tested a malfunctioning sensor, according to the three officials. That one popped out to me. Man. Lots to learn. > Boeing continued to defend MCAS and its reliance on a single sensor after the first crash, involving Indonesia’s Lion Air. Also...how? So many non safety critical services use a load balancer and at least a couple of servers because who can trust just one thing working perfectly all the time?
  • m_mueller 7y ago
    Another one that popped out: test pilots were pushed to simulator-only by management, with simulators apparently being incomplete with regards to MCAS behavior. Bean counting and incompetence abound in safety critical areas of airplane design - I will think twice before stepping in another recent model of Boeing.
• uptownfunk 7y ago
  Whatever it's worth, this whole thing has traumatized me so much it makes me fearful of flying at all. But one thing's for sure, if I have any say, I'll probably never fly a 737 MAX again. I'm sure there are many people who will do the same. In fact, every flight I do go on now, I check to make sure it is not a MAX. I doubt there will be enough people who think this way that it would cause a problem economically for any airlines that carry this line, and I'm sure with time, people will forget, but I sure as hell will do my best not to.
• tomglynch 7y ago
  I posted this as a comment the other day in another Boeing and MCAS discussion. In my research into the topic the saddest bit of information I've seen is the image of the black box data for the flight (the first crash): https://i.imgur.com/WJuhjlO.png https://i.imgur.com/WJuhjlO.png You can see from the graph that in the final minutes and seconds, the pilot put insane amounts of force on the control column (aka the yoke) to try to pull the plane out of the dive - to save the 189 people on board. But no, MCAS was overpowering and lacked the documentation for the pilot to try anything else. Also interesting to see is the amount of times the pilots bring the nose up, only for MCAS to kick in and force the nose back down. 26 times. All data from this Seattle Times article, which was written before the second crash occurred: [1] https://www.seattletimes.com/business/boeing-aerospace/black-box-data-reveals-lion-air-pilots-struggle-against-boeings-737-max-flight-control-system/ https://www.seattletimes.com/business/boeing-aerospace/black...
  • daodedickinson 7y ago
    The SEC was given a complete explanation of Bernie Madoff's scam back in the 1990's.
  • bowmessage 7y ago
    Interesting that there are two angle of attack sensor readings in the black box image when the major issue with MCAS seems to be that it was relying on only a single sensor?
    • spockz 7y ago
      MCAS use(s/d) one sensor at a time, rotating which one is used.
    • londons_explore 7y ago
      Apart from at the start (when the plane is on the ground), both sensors seem to report the same data? So why did it crash?
  • sirsuki 7y ago
    If the pilots were putting that much force on the yoke it is pretty apparent that the pilots really truly wanted the plan to do what they asked of it. I am curious what scenarios the designers of the plan drove then to not trust that the human in the seat really has no idea what they are doing. Was the ignoring the wishes of the pilot and attempt to prevent a crazed irresponsible and unlicensed idiot from doing something? These are trained humans why does the computer totally ignore there efforts?
• sixdimensional 7y ago
  I am surprised that I haven’t seen anyone make the connection to “normal accidents” [1] yet, but feel it is quite relevant in this case. [1] https://en.wikipedia.org/wiki/Normal_Accidents https://en.wikipedia.org/wiki/Normal_Accidents
• pseingatl 7y ago
  Why didn't they just bring back the already-certified 757 instead of stretching the 737?
  • _ph_ 7y ago
    The problem isn't the certification of the plane, it is the certification of the pilot. A 757 or a true successor to the 737 would have meant that pilots would have to be certified for the new plane - and that means they lose their certification for the plain 737. The MAX is targetted at carriers which already have large fleets of 737 and the idea was that the same pilot could fly both.
• sho 7y ago
  Great article. But for me there's a huge question being left unanswered, like the elephant in the room: Why did exactly did the engineers/test pilots feel the need to "enhance" the original MCAS with the new, more powerful version that worked at lower speeds? What did they know? I doubt they did it for the hell of it. And therefore, what has changed that that enhanced functionality is now no longer necessary, and it's fine that MCAS is being returned to its original, more subtle implementation? These things just don't add up for me and Boeing's constant pronouncements that they did nothing wrong, everything was fine, and now they're fixing it so everything will be even more fine ring very hollow indeed. I would almost like to see everyone involved in this subpoenaed so the public can learn the truth of what, exactly, took place. Until we have some answers, especially to my main one - what was so bad about the airframe's handling that it was necessary to massively increase the power of the MCAS system, but is now apparently not necessary anymore and it's fine for them to nerf it - I don't think I'll be flying on a MAX.
  • TazeTSchnitzel 7y ago
    The answer to why they wanted to “enhance” MCAS is that they wanted it to be certified as a 737 like all previous versions, which means pilots need to be able to fly it exactly like previous 737s without additional training, and a technical hack which “corrects” pilots' actions facilitates that.
• Haga 7y ago
  Empires destroy institutions.. they hollow them out until are barely cloths for one figure residing within. Proofing something to an institution is hard. Proofing something to one person is "easyish". The problem is not that one plane manufacturers internal culture allowed falling behind, but that this rot and decay bypassed controlling institutions, because these where hollowed out for empire reasons. You can not defeat this problem unless you solve the root node. Which are hidden deals instead of proper procedure replacing the physics of capitalism.
• Glawen 7y ago
  I'm surprised noone yet on HN mentionned how Rust would have avoided the failure :)
• zeristor 7y ago
  How confident is everyone on all the other changes to the 737? They’ve found the MCAS issues, but with a procedure this lax I’d expect several other issues to have gotten through.
• rmtech 7y ago
  I've never understood why they make planes with 1-2 sensors for a crucial reading like airspeed. Why not have 20 airspeed sensors of 5 different types? It's an obvious failure mode that your one sensor will fail and then the pilots and the computer will be left in a state of dangerous uncertainty about the situation.
• laythea 7y ago
  Sounds to me like the main failure here is that Boeing went too far with optimising cost, in the sense that MCAS was not properly designed. I'm certain correctly designed software can safely control critical functions, otherwise failure in a large category of aircraft systems would result in many more MCAS unrelated accidents. This particular MCAS control philosophy seems to be a flawed control system. With reference to the the graph (link provided by obituary_latte): https://i.imgur.com/WJuhjlO_d.jpg?maxwidth=1640&shape=thumb&fidelity=high https://i.imgur.com/WJuhjlO_d.jpg?maxwidth=1640&shape=thumb&... With only one sensor being "looked at" at any time, and with the system not having the sense to know to stop commanding pitch down after 26 times with attempted pilot overrides, it would seem almost beyond belief that any competent team of on-the-ground engineers (as per Boeing) would not see that the system is flawed. Would be interesting to see if this was the case, and how the likely good engineering decision was overridden by the commercial aspect. With increased tech, comes increased scope for this kind of cost optimisation, and we must be careful in many more industries. Eg Automotive self driving cars.
• hwestiii 7y ago
  This article reads to me like Boeing and the FAA have gotten their stories straight with each other and in naming names have settled upon someone who is no longer associated with either in an effort to take the heat off of both.
• ackfoo 7y ago
  There was indeed a deadly assumption in the design of the 737 Max: that pilots would be able to cope with a runaway trim problem by invoking a memory checklist. Neither the Lion Air nor the Ethiopian pilots were able to do so, although the Lion Air crew that flew the same aircraft and encountered the same problem the day before managed to disable the electric trim and continue the flight to its destination without even inconveniencing the passengers. This is not a design problem with the 737 Max. It is an indictment of the pilot training, economic, and social systems affecting the operation of some airlines. The article fails to make it clear that the MCAS is, in fact, inactive for almost all of a normal flight: it is not operative when the autopilot is engaged, and it is not operative when the flaps are extended. Furthermore, it is of no consequence whether the MCAS is specifically included in the flight manual because there is no possibility for the pilots to interact directly with the MCAS system; this can only happen through the runaway trim memory checklist. The aircraft will be modified to use multiple sensors and to diminish the authority of MCAS. This will do nothing whatsoever to address the actual and growing problem that caused these incidents, which is the increasing tendency for pilots to be capable monitors of automated flight systems, but absolutely useless at flying the plane manually when those systems fail. Thee will continue to be an increasing number of these type of incidents until we understand that not everything can be made cheaper and that objective facts exist and must guide our actions. Our deflationary system enriches the few and keeps the rest happy by striving for ever-cheaper goods. We should be looking at pilots in the right seat of commercial aircraft with 98 hours of total flight time and saying, "no, that's beyond the limit of madness; we want quality of life instead of cheap goods and the pipe dream of wealth." That won't matter to most of the ignorant reactionaries commenting in this thread who are looking to point the finger of blame anywhere but ourselves.
• supergirl 7y ago
  how is it that boeing still has not admitted fault? i guess they bet to get out through a loophole in the investigation result; investigation that they are part of i assume? something like "it was 1% pilot error" is enough to make a pr campaign from.