4 ms·

> it was for a dynamics/physics problem Not exactly. The plane was (and still is) perfectly flyable without MCAS, but its handling characteristic were suffici

by lisper 4y ago

> it was for a dynamics/physics problem Not exactly. The plane was (and still is) perfectly flyable without MCAS, but its handling characteristic were sufficiently different from the plane it was designed to replace that it required pilots to be retrained. That made its value proposition less attractive because of the extra training costs. MCAS was an attempt to make the new plane handle like the old one so pilots would not have to be retrained. And it failed catastrophically. The point is, it was a completely artificial problem produced by business considerations, not physics.

WalterBright 4y ago
> it was a completely artificial problem produced by business considerations Making the plane behave the same as a different airplane makes it safer. There are many examples of crashes due to pilots reacting to an emergency in a manner appropriate to the previous plane they were flying, rather than the current one. About 98% of the mass media reporting on MCAS was written by people who have no idea how airplanes work, and is hysterical nonsense.
- lisper 4y ago
  Well, I'm a (private) pilot, so I like to think I have some clue about how airplanes work. It's true that, all else being equal, making an airplane's handling characteristics the same as a familiar predecessor improves safety. But clearly all else was not equal here.
  - WalterBright 4y ago
    There was nothing wrong with the MCAS concept. What was wrong was its reliance on a single sensor, such that a bad sensor made it misbehave. Other things wrong with it were it had too much authority, and it should have disabled itself if the pilot was countermanding it with the control column. The other thing wrong was the pilots not using the stab trim cutoff switch, which is supposed to be a "memory item" for them. I worked on the design of the 757 stabilizer trim system. The cutoff switch was always the backup for things going wrong with the trim. It's right there on the console within easy reach for a damn good reason. (Other systems could be turned off by overhead circuit breakers, but the stab trim cutoff was placed in a special priority position.) As for needing software at all, all jetliners have an active yaw damper to keep the pointy end forward. This is to counter a stability problem from having swept wings. Pilots of low&slow straight wing aircraft are often not familiar with this. A Cessna will be stable if you just let go of the controls. A swept wing jetliner, not without augmentation. The mass media also omits the reason for the MAX. The new engines gave it 15% less fuel burn. This is massive cost savings (and less pollution, too.)
    - cameldrv 4y ago
      Yes, the cutoff would have worked had it been activated quickly enough. The failure is insidious though. a) When MCAS falsely activates, it only does so briefly. Then, assuming the problem is that the AoA sensor is broken, it activates again every five seconds. This is very confusing as the problem appears to have resolved and then it comes back. b) During initial climb, other parts of the speed trim system are normally working and the trim wheel is turning and clacking with no input from the pilot. If not for the big pitch down, the extra MCAS inputs would not be otherwise noticeable. c) The pilots had no way of knowing that MCAS even existed, because all references to it were deleted from the flight manual, so they had no way of being ready for such a set of circumstances. d) After MCAS has activated a couple of times, if you then recognize a problem and flip the trim cutoff, you lose the manual electric trim as well, and the trim is so nose down that you don't have the physical strength to turn the trim wheels. If you turn the trim cutoff back on to try to recover control, MCAS will hit you again. e) The procedure on previous versions of the 737 for dealing with a plane so out of trim that you couldn't turn the wheel was to pitch down even more to unload the stabilizer and then crank the trim wheel, but this procedure was also deleted from the flight manual, I believe as of the 737 Classic series.
    - lisper 4y ago
      I fly an SR22, which has a yaw damper. It's not strictly necessary -- the SR22 is quite stable without it -- but I'm familiar with the concept. The facts of the MCAS debacle have been litigated to death (literally!) and since you work in the industry you probably know more about them than I do. However, I'm still going to respectfully take issue with this: > There was nothing wrong with the MCAS concept. That's a vacuous claim because "the MCAS concept" is not well-defined. If "the MCAS concept" is something like "an automated control system that always does the Right Thing" then obviously there is nothing wrong with that. But MCAS was never an automated control system that always did the Right Thing. The problems with it were known -- indeed, self-evident -- long before anyone actually died. MCAS was explicitly designed to be an automated control system that sometimes did the Right Thing, and sometimes did the Wrong Thing (with a single point of failure), but that was OK because when it did the Wrong Thing, the human pilots would take over and do the Right Thing in its place [1]. I think it's pretty clear, even without the rather definitive evidence in the form of two lost aircraft, that there is quite a bit wrong with that concept. But maybe we'll just have to agree to disagree about that. And, somewhat less respectfully... > The new engines gave it 15% less fuel burn. This is massive cost savings (and less pollution, too.) I'm sure the families of the victims will take great comfort knowing that their loved ones died efficiently. --- [1] UPDATE: And, I might add, that they were expected to do the Right Thing without any additional training because the whole point of MCAS was to make the new plane behave like the old plane. Which is manifestly failed at rather spectacularly. But that is neither here nor there because I think the case can be made that the "MCAS concept" was flawed even without this little detail.
- bumby 4y ago
  Are you making the claim that MCAS made the plane behave similar to previously certified designs? Maybe that was the intent, but the execution seemed very much the opposite. That's largely the point: the software workarounds don't behave like a hardware-engineered mitigation.
  - WalterBright 4y ago
    The MCAS system is still on the 737MAX. > the software workarounds don't behave like a hardware-engineered mitigation You probably should never get on an Airbus, because they won't fly without computers.
    - bumby 4y ago
      I'm aware that MCAS is still in use. You may be conflating what I'm saying. I'm not making a claim that software is inherently dangerous. I'm making the claim that software as a workaround to sound risk mitigation is dangerous, especially when it's a workaround for a hardware problem because of the interaction effects. It's pretty clear from the hazard analysis and subsequent decisions that Boeing didn't understand and mitigate the MCAS risk effectively. And, yes, I'm aware of the two philosophical camps regarding ultimate authority in command (pilot vs. software). That doesn't negate my point. Software, in either case, shouldn't be a workaround solely because it's easier to implement than a hardware change. Using it as an engineered mitigation is ok, but you have to actually implement the mitigations properly. For example, the hazard analysis listed MCAS as "critical". With that classification, it required redundant sensors, yet Boeing didn't make that the default and opted instead to sell it as an option. (Never mind the fact that the classification should have been higher, they didn't even follow through with their own processes based on the mis-classification).
      - WalterBright 4y ago
        > I'm making the claim that software as a workaround to sound risk mitigation is dangerous Mechanical systems aren't inherently better or more resistant to hidden flaws. Remember it was a failure of the mechanical AOA sensor that initiated the MCAS failure. > Software, in either case, shouldn't be a workaround solely because it's easier to implement than a hardware change. Software runs our world now. Mechanical computers on airplanes were around for decades before software, and they were hardly free of fault and problems.

by lisper 4y ago

WalterBright 4y ago

> it was a completely artificial problem produced by business considerations Making the plane behave the same as a different airplane makes it safer. There are many examples of crashes due to pilots reacting to an emergency in a manner appropriate to the previous plane they were flying, rather than the current one. About 98% of the mass media reporting on MCAS was written by people who have no idea how airplanes work, and is hysterical nonsense.

lisper 4y ago
Well, I'm a (private) pilot, so I like to think I have some clue about how airplanes work. It's true that, all else being equal, making an airplane's handling characteristics the same as a familiar predecessor improves safety. But clearly all else was not equal here.
- WalterBright 4y ago
  There was nothing wrong with the MCAS concept. What was wrong was its reliance on a single sensor, such that a bad sensor made it misbehave. Other things wrong with it were it had too much authority, and it should have disabled itself if the pilot was countermanding it with the control column. The other thing wrong was the pilots not using the stab trim cutoff switch, which is supposed to be a "memory item" for them. I worked on the design of the 757 stabilizer trim system. The cutoff switch was always the backup for things going wrong with the trim. It's right there on the console within easy reach for a damn good reason. (Other systems could be turned off by overhead circuit breakers, but the stab trim cutoff was placed in a special priority position.) As for needing software at all, all jetliners have an active yaw damper to keep the pointy end forward. This is to counter a stability problem from having swept wings. Pilots of low&slow straight wing aircraft are often not familiar with this. A Cessna will be stable if you just let go of the controls. A swept wing jetliner, not without augmentation. The mass media also omits the reason for the MAX. The new engines gave it 15% less fuel burn. This is massive cost savings (and less pollution, too.)
  - cameldrv 4y ago
    Yes, the cutoff would have worked had it been activated quickly enough. The failure is insidious though. a) When MCAS falsely activates, it only does so briefly. Then, assuming the problem is that the AoA sensor is broken, it activates again every five seconds. This is very confusing as the problem appears to have resolved and then it comes back. b) During initial climb, other parts of the speed trim system are normally working and the trim wheel is turning and clacking with no input from the pilot. If not for the big pitch down, the extra MCAS inputs would not be otherwise noticeable. c) The pilots had no way of knowing that MCAS even existed, because all references to it were deleted from the flight manual, so they had no way of being ready for such a set of circumstances. d) After MCAS has activated a couple of times, if you then recognize a problem and flip the trim cutoff, you lose the manual electric trim as well, and the trim is so nose down that you don't have the physical strength to turn the trim wheels. If you turn the trim cutoff back on to try to recover control, MCAS will hit you again. e) The procedure on previous versions of the 737 for dealing with a plane so out of trim that you couldn't turn the wheel was to pitch down even more to unload the stabilizer and then crank the trim wheel, but this procedure was also deleted from the flight manual, I believe as of the 737 Classic series.
  - lisper 4y ago
    I fly an SR22, which has a yaw damper. It's not strictly necessary -- the SR22 is quite stable without it -- but I'm familiar with the concept. The facts of the MCAS debacle have been litigated to death (literally!) and since you work in the industry you probably know more about them than I do. However, I'm still going to respectfully take issue with this: > There was nothing wrong with the MCAS concept. That's a vacuous claim because "the MCAS concept" is not well-defined. If "the MCAS concept" is something like "an automated control system that always does the Right Thing" then obviously there is nothing wrong with that. But MCAS was never an automated control system that always did the Right Thing. The problems with it were known -- indeed, self-evident -- long before anyone actually died. MCAS was explicitly designed to be an automated control system that sometimes did the Right Thing, and sometimes did the Wrong Thing (with a single point of failure), but that was OK because when it did the Wrong Thing, the human pilots would take over and do the Right Thing in its place [1]. I think it's pretty clear, even without the rather definitive evidence in the form of two lost aircraft, that there is quite a bit wrong with that concept. But maybe we'll just have to agree to disagree about that. And, somewhat less respectfully... > The new engines gave it 15% less fuel burn. This is massive cost savings (and less pollution, too.) I'm sure the families of the victims will take great comfort knowing that their loved ones died efficiently. --- [1] UPDATE: And, I might add, that they were expected to do the Right Thing without any additional training because the whole point of MCAS was to make the new plane behave like the old plane. Which is manifestly failed at rather spectacularly. But that is neither here nor there because I think the case can be made that the "MCAS concept" was flawed even without this little detail.
bumby 4y ago
Are you making the claim that MCAS made the plane behave similar to previously certified designs? Maybe that was the intent, but the execution seemed very much the opposite. That's largely the point: the software workarounds don't behave like a hardware-engineered mitigation.
- WalterBright 4y ago
  The MCAS system is still on the 737MAX. > the software workarounds don't behave like a hardware-engineered mitigation You probably should never get on an Airbus, because they won't fly without computers.
  - bumby 4y ago
    I'm aware that MCAS is still in use. You may be conflating what I'm saying. I'm not making a claim that software is inherently dangerous. I'm making the claim that software as a workaround to sound risk mitigation is dangerous, especially when it's a workaround for a hardware problem because of the interaction effects. It's pretty clear from the hazard analysis and subsequent decisions that Boeing didn't understand and mitigate the MCAS risk effectively. And, yes, I'm aware of the two philosophical camps regarding ultimate authority in command (pilot vs. software). That doesn't negate my point. Software, in either case, shouldn't be a workaround solely because it's easier to implement than a hardware change. Using it as an engineered mitigation is ok, but you have to actually implement the mitigations properly. For example, the hazard analysis listed MCAS as "critical". With that classification, it required redundant sensors, yet Boeing didn't make that the default and opted instead to sell it as an option. (Never mind the fact that the classification should have been higher, they didn't even follow through with their own processes based on the mis-classification).
    - WalterBright 4y ago
      > I'm making the claim that software as a workaround to sound risk mitigation is dangerous Mechanical systems aren't inherently better or more resistant to hidden flaws. Remember it was a failure of the mechanical AOA sensor that initiated the MCAS failure. > Software, in either case, shouldn't be a workaround solely because it's easier to implement than a hardware change. Software runs our world now. Mechanical computers on airplanes were around for decades before software, and they were hardly free of fault and problems.