5 ms·

This is a common argument that sounds reasonable but is actually based on faulty logic. Airbus pilots can't safely fly their jets at cruising speed without sof

This is a common argument that sounds reasonable but is actually based on faulty logic. Airbus pilots can't safely fly their jets at cruising speed without software (envelope protection, etc) assisting them. Air France 447 crashed, killing 228 people, when that software became disabled due to bad values from frozen sensors. The pilot flying thought the software would save him from stalling but that protection was disabled, so he crashed into the ocean. So does that mean it's a bad idea to make flight software safety critical? Probably not. It probably just means that safety critical software must be extremely good. MCAS v1 was not good software but if MCAS v2 is good software then it could might function safely for decades. And, if MCAS v1 had been good, it would have been lauded as a great solution. Engineering is about trade offs and maybe Boeing made the wrong trade off here. Ideally, you would have as little safety critical software as possible. But the fundamental concept of software correcting for flight characteristics seems entirely sound.

codedokode 7y ago
But this software hack was added only to save a little amount of fuel (and money to retraint the pilots or redesign the airplane frame). Maybe it is better to have a slightly more expensive, but safer plane?
- staunch 7y ago
  And what if a totally redesigned successor to the 737 started crashing due to a technical issue, or training issue? Second System Syndrome is a well known engineering pitfall. If the only thing wrong with the 737 MAX is that the MCAS v1 software is bad, and the MCAS v2 software is good, then the 737 MAX should fly perfectly well for decades.
salawat 7y ago
If you look as far back as the 60's, there was a lot of resistance from pilots with regard to unsafe airframes where various forms of trickery were employed to cover up problematic behavior. Check the D.P. Davies Interview by the Royal Aeronautics Society with regards to the 727. Even plastering over minor behavior near stall was a controversial move due to fears of pilot's at the time of starting down a slippery slope where more and more non-regulation compliant airframes were allowed to be certified because there would be some system X that would compensate for the aircraft's bad behavior. The fear being that eventually there would be so much automation between the pilot and the end behavior of the plane, that you might as well have a dog in the cockpit to bite the pilot should he try to mess with anything; and that should anything go wrong, the pilot would be helpless due to the plane only really being airworthy to his level of skill with the automation in place. Boeing historically built planes flown by pilots. Every aspect of the planes behavior had a way for the pilot to control it. A Boeing plane would follow a pilot right out of the flight envelope, at least maintaining a 1:1 binding of pilot intent to plane output behavior. Airbus makes planes flown by automation, directed by pilots, that should that automation fail, requires a significant investment of skill maintenance to know what not to do at that time. This makes common UI for the pilot easier to implement, but comes with discipline degradation through having a computer that will largely ignore your daft commands until it suddenly has no way to measure your daftness, leaving you with a plane with a hodgepodge of reliable automation to reason through about whether or not the plane will do something daft if you order it to. History may show who won that argument, (Airbus does exist), but the fact does remain today that aircraft that one wants to certify as flying just like another aircraft (MAX flying like a 737) should actually do so. The MAX doesn't; the technological fix intended to make it so was not developed to a sufficient standard of rigor, or communicated to pilot clearly enough, to transparently account for that aerodynamic divergence. The problem is multi-faceted, yes; but the statement that the MAX suffered from a fundamental design flaw is absolutely accurate. The flaw exists aerodynamically, and in the fundamental engineering process through which it was certified. [1]https://www.aerosociety.com/news/audio-the-d-p-davies-interview-on-the-boeing-747-the-trident-vc10-one-eleven-the-boeing-727/ https://www.aerosociety.com/news/audio-the-d-p-davies-interv...
- staunch 7y ago
  Interesting stuff, thanks. But my understanding is that other jets have a similar pitch up characteristics and no one considers them to be fundamentally flawed. That the 737 MAX design creates a new problem vs the 737-NG does not necessarily mean it's fundamentally flawed. I'd only consider it a fundamental flaw if MCAS can't actually be designed to compensate for the problem. An unsolvable problem due to bad design = fundamental flaw. Otherwise having to stick a windshield on the front of an airplane could be considered a fundamental flaw. But it's not considered one because of very strong laminated materials compensating for the the problem. And yet it's still a huge potential risk. Windshields have cracked, broken, clouded up, etc.
  - salawat 7y ago
    The behavior held common with the other 737 variants is a tendency to pitch up with the application of power. All aircraft with underslung engines share this characteristic. MAX, however, has additional problems where its flyability is adversely impacted when flying at high Angles of Attack when the engine nacelles (positioned higher and in front of the wing) creates extra lift in front of the center of mass of the aircraft. This creates divergences from the normal "control feel" of the older aircraft. When at low power, and high AoA, (such as might be experienced on descent), sudden applications of power can cause pitch up, which can put the plane at an AoA that experiences this handling divergence. MCAS, in it's second form, was intended to induce a controlled mistrim to compensate for both it's original purpose (high speed, high AoA divergence from 737 NG handling), and a low speed, high AoA handling divergence. It was being modified to handle the low speed case that removed an extra G-Load based cross check, and greatly increased the authority the MCAS system commanded, due to the larger deflections required to induce attitude changes in the low speed portions of the flight envelope. The fundamental flaw I mention, is several fold. Requirementswise: A)The MAX had to be developed yesterday to allow Boeing to maintain dominance/market share in narrow body civil transport against the A320neo. (They needed it fast) B) It had to be cheap. They needed minimum overhead cost to appease airlines, and comparable fuel efficiency to the A320neo. This meant no blank slate redesign. This locked them into the 737 type cert. This meant (to an engineer): C) It had to fly exactly like a 737... Without being one (They need it to be right). In engineering, there is a common saying: You can get it done cheap You can get it done fast. You can get [everything you want] done right). Pick two. For success, they needed all three, and delivering the third was not allowed the flexibility to intrude on either of the other points of the triad areas of process. The only way this project could have ended was with a breakdown somewhere in the process. That breakdown was in communication and propagation of the significance of the aerodynamics change. That failure in communication was bundled in the "fast and cheap" directive. The "right" directive required the aerodynamics divergence, and the software control system reconfiguration to compensate for it. The cheap and fast also required that the software solution not be driven by a dual sensor system, as that wouldn't have been allowed through without simulator training by the FAA, as testified to by a whistleblower as reported in the Australian 60 minutes expose. The whole thing is just a Greek tragedy in an engineering project's clothing. Hubris, greed, equivocation, catastrophe... It's all there.

codedokode 7y ago

But this software hack was added only to save a little amount of fuel (and money to retraint the pilots or redesign the airplane frame). Maybe it is better to have a slightly more expensive, but safer plane?

staunch 7y ago
And what if a totally redesigned successor to the 737 started crashing due to a technical issue, or training issue? Second System Syndrome is a well known engineering pitfall. If the only thing wrong with the 737 MAX is that the MCAS v1 software is bad, and the MCAS v2 software is good, then the 737 MAX should fly perfectly well for decades.

salawat 7y ago

If you look as far back as the 60's, there was a lot of resistance from pilots with regard to unsafe airframes where various forms of trickery were employed to cover up problematic behavior. Check the D.P. Davies Interview by the Royal Aeronautics Society with regards to the 727. Even plastering over minor behavior near stall was a controversial move due to fears of pilot's at the time of starting down a slippery slope where more and more non-regulation compliant airframes were allowed to be certified because there would be some system X that would compensate for the aircraft's bad behavior. The fear being that eventually there would be so much automation between the pilot and the end behavior of the plane, that you might as well have a dog in the cockpit to bite the pilot should he try to mess with anything; and that should anything go wrong, the pilot would be helpless due to the plane only really being airworthy to his level of skill with the automation in place. Boeing historically built planes flown by pilots. Every aspect of the planes behavior had a way for the pilot to control it. A Boeing plane would follow a pilot right out of the flight envelope, at least maintaining a 1:1 binding of pilot intent to plane output behavior. Airbus makes planes flown by automation, directed by pilots, that should that automation fail, requires a significant investment of skill maintenance to know what not to do at that time. This makes common UI for the pilot easier to implement, but comes with discipline degradation through having a computer that will largely ignore your daft commands until it suddenly has no way to measure your daftness, leaving you with a plane with a hodgepodge of reliable automation to reason through about whether or not the plane will do something daft if you order it to. History may show who won that argument, (Airbus does exist), but the fact does remain today that aircraft that one wants to certify as flying just like another aircraft (MAX flying like a 737) should actually do so. The MAX doesn't; the technological fix intended to make it so was not developed to a sufficient standard of rigor, or communicated to pilot clearly enough, to transparently account for that aerodynamic divergence. The problem is multi-faceted, yes; but the statement that the MAX suffered from a fundamental design flaw is absolutely accurate. The flaw exists aerodynamically, and in the fundamental engineering process through which it was certified. [1]https://www.aerosociety.com/news/audio-the-d-p-davies-interview-on-the-boeing-747-the-trident-vc10-one-eleven-the-boeing-727/ https://www.aerosociety.com/news/audio-the-d-p-davies-interv...

staunch 7y ago
Interesting stuff, thanks. But my understanding is that other jets have a similar pitch up characteristics and no one considers them to be fundamentally flawed. That the 737 MAX design creates a new problem vs the 737-NG does not necessarily mean it's fundamentally flawed. I'd only consider it a fundamental flaw if MCAS can't actually be designed to compensate for the problem. An unsolvable problem due to bad design = fundamental flaw. Otherwise having to stick a windshield on the front of an airplane could be considered a fundamental flaw. But it's not considered one because of very strong laminated materials compensating for the the problem. And yet it's still a huge potential risk. Windshields have cracked, broken, clouded up, etc.
- salawat 7y ago
  The behavior held common with the other 737 variants is a tendency to pitch up with the application of power. All aircraft with underslung engines share this characteristic. MAX, however, has additional problems where its flyability is adversely impacted when flying at high Angles of Attack when the engine nacelles (positioned higher and in front of the wing) creates extra lift in front of the center of mass of the aircraft. This creates divergences from the normal "control feel" of the older aircraft. When at low power, and high AoA, (such as might be experienced on descent), sudden applications of power can cause pitch up, which can put the plane at an AoA that experiences this handling divergence. MCAS, in it's second form, was intended to induce a controlled mistrim to compensate for both it's original purpose (high speed, high AoA divergence from 737 NG handling), and a low speed, high AoA handling divergence. It was being modified to handle the low speed case that removed an extra G-Load based cross check, and greatly increased the authority the MCAS system commanded, due to the larger deflections required to induce attitude changes in the low speed portions of the flight envelope. The fundamental flaw I mention, is several fold. Requirementswise: A)The MAX had to be developed yesterday to allow Boeing to maintain dominance/market share in narrow body civil transport against the A320neo. (They needed it fast) B) It had to be cheap. They needed minimum overhead cost to appease airlines, and comparable fuel efficiency to the A320neo. This meant no blank slate redesign. This locked them into the 737 type cert. This meant (to an engineer): C) It had to fly exactly like a 737... Without being one (They need it to be right). In engineering, there is a common saying: You can get it done cheap You can get it done fast. You can get [everything you want] done right). Pick two. For success, they needed all three, and delivering the third was not allowed the flexibility to intrude on either of the other points of the triad areas of process. The only way this project could have ended was with a breakdown somewhere in the process. That breakdown was in communication and propagation of the significance of the aerodynamics change. That failure in communication was bundled in the "fast and cheap" directive. The "right" directive required the aerodynamics divergence, and the software control system reconfiguration to compensate for it. The cheap and fast also required that the software solution not be driven by a dual sensor system, as that wouldn't have been allowed through without simulator training by the FAA, as testified to by a whistleblower as reported in the Australian 60 minutes expose. The whole thing is just a Greek tragedy in an engineering project's clothing. Hubris, greed, equivocation, catastrophe... It's all there.