6 ms·

Surely you know this, but MCAS was a badly designed system that failed in a fatal manner in the event of malfunctioning non-redundant sensor (10s of failure eve

Surely you know this, but MCAS was a badly designed system that failed in a fatal manner in the event of malfunctioning non-redundant sensor (10s of failure events per year). Boeing knew this, but allowed it kill everyone aboard two flights. Documentation in the instructions or not it had no business being on a commercial aircraft, ever.

signatoremo 1y ago
It still exists today after modification that requires input from both AOA sensors. Why do you think it’s badly designed? The implementation was badly done for sure.
- filleduchaos 1y ago
  Design and implementation are not completely distinct things, though. If e.g. a software company's backups were implemented solely as daily dumps to the same SSD the database was running on, and then they implemented a more sane backup solution after the practically-inevitable data loss, would we just go "well the implementation was badly done" or would people not call it out as bad systems design? Some designs are so poorly thought through (and/or conceived for the wrong reasons to begin with, like MCAS was) that they cannot help but yield poor implementations. (Also, input from one or two sensors was far from the only problem with MCAS' implementation. The fact that it could activate multiple times and that it could trim far harder and faster than human pilots could manually trim were equally contributors to making the saga a tragedy).
  - WalterBright 1y ago
    > conceived for the wrong reasons The reasons were correct. Making the MAX behave, as far as the pilots were concerned, like other models of the 737 makes the airplane safer. Many crashes have resulted from pilots getting confused about which airplane they are flying. The design particulars, however, were incorrect. That is Boeing's fault. > trim far harder and faster The 737 has only one electric trim rate - on and off. It does not trim harder or faster than the autopilot trim or the thumb switch trim. The signal all boils down to a wire that has signals "trim on / trim off". The thumb switches sit on the path of that wire, so when they activate they override the autopilot and MCAS. The cutoff switch is downstream of that. Part of the reason the manual trim wheel could not be moved is the airplane was overspeeding due to being (incorrectly) at full throttle. Overspeeding greatly increases the force on the stabilizer, making it much harder to move. In the EA flight, the overspeed warning horn could be heard on the voice recorder.
    - filleduchaos 1y ago
      The only reason why "making it behave like other 737s" was even a goal to begin with was so that it wouldn't need to undergo more rigorous certification and pilots wouldn't have to undergo comprehensive training to get rated for the 737 MAX. This was very explicitly because pilots _didn't_ need to do that to get rated for the competing A320neo family, not because Airbus did absurd shenanigans to make it handle the same as the A320ceos, but because they weren't desperately holding on to a 1960s design that was amongst other things so low to the ground that the new engines being fitted to it couldn't actually fit. That has nothing to do with actual safety and everything to do with profit. > The 737 has only one electric trim rate - on and off. It does not trim harder or faster than the autopilot trim or the thumb switch trim Is there a reason you cut off the sentence you're quoting before the part that says "than human pilots could MANUALLY trim" and started talking about the electric trim rate instead? Because that part of the sentence was written for a reason - the overwhelmingly more relevant reason why the manual trim wheel would not have saved them is that they would have had to crank it 15 times to trim just one degree (and they were much more than one degree out of trim, due to MCAS activating for five full seconds each time). Even if they weren't already overspeeding, it is highly doubtful that they would have won the battle to keep the aircraft in the air given their proximity to the ground + struggle to keep the nose above the horizon with two pilots versus one. Also mind you by the time they entered the overspeed condition, they had already had the stick shaker going (due to the faulty AoA sensor, with no IAS disagree alert) and had had 2 MCAS activations to deal with, with the autothrottle failing to reduce the thrust to the climb detent because the very same faulty AoA sensor.
- anonymars 1y ago
  Isn't the fact that it was redesigned (to not rely on a single AoA sensor, to only activate once per AoA-event, to limit the magnitude of intervention) a strong indication that it was badly designed?
- wat10000 1y ago
  It was implemented exactly as designed.
WalterBright 1y ago
I know this. I also know that there were 3 MCAS incidents. On the first one, the crew restored normal trim with the thumb switches, then turned off the stab trim system. They had no idea that MCAS existed, they simply followed standard procedure for runaway trim. After the first crash, Boeing sent around an Emergency Airworthiness Directive to all MAX pilots with the two steps I showed. There's no excuse for MAX pilots not reading, understanding, and remembering Emergency Airworthiness Directives. It's not just me. I've talked to two 737 pilots who said the same thing.
- throwaway5752 1y ago
  I see in a sibling comment that you do not think the MCAS system on the MAX was well designed, and the reliance on a single AoA sensor was not a good decision. I agree. The aircraft should have never been declared airworthy. There should have been no need for an EAD in the first place. There is no excuse for putting a control system that flies the craft into the ground when there is a failure in a nonredundant sensor on a commercial aircraft. The high standards required for pilots, like Amelia Earhart, do not obviate the even higher standards for quality and safety from manufacturers.
  - WalterBright 1y ago
    I suspect that Boeing didn't think it would be a problem because the runaway stab trim procedure is enough to stop it and recover. Who would have thought that trained pilots would not remember this procedure? It's supposed to be a "memory item", meaning consulting the checklist was not required. The stab trim cutoff switch is in a prominent position on the central console (not overhead or behind the crew). In the first Lion Air crash, the airplane dipped and recovered (via the thumb switches) 25 times over a period of 11 minutes. They never thought to turn off the stab trim system. It boggles the mind. Would you want to fly with a crew that didn't know what the switches on the console were for? Not me. Both Boeing and the crew are at fault. Some percentage also for whoever made the faulty sensor and the failure to see that it worked correctly after it was installed.
    - 1y ago

signatoremo 1y ago

It still exists today after modification that requires input from both AOA sensors. Why do you think it’s badly designed? The implementation was badly done for sure.

filleduchaos 1y ago
Design and implementation are not completely distinct things, though. If e.g. a software company's backups were implemented solely as daily dumps to the same SSD the database was running on, and then they implemented a more sane backup solution after the practically-inevitable data loss, would we just go "well the implementation was badly done" or would people not call it out as bad systems design? Some designs are so poorly thought through (and/or conceived for the wrong reasons to begin with, like MCAS was) that they cannot help but yield poor implementations. (Also, input from one or two sensors was far from the only problem with MCAS' implementation. The fact that it could activate multiple times and that it could trim far harder and faster than human pilots could manually trim were equally contributors to making the saga a tragedy).
- WalterBright 1y ago
  > conceived for the wrong reasons The reasons were correct. Making the MAX behave, as far as the pilots were concerned, like other models of the 737 makes the airplane safer. Many crashes have resulted from pilots getting confused about which airplane they are flying. The design particulars, however, were incorrect. That is Boeing's fault. > trim far harder and faster The 737 has only one electric trim rate - on and off. It does not trim harder or faster than the autopilot trim or the thumb switch trim. The signal all boils down to a wire that has signals "trim on / trim off". The thumb switches sit on the path of that wire, so when they activate they override the autopilot and MCAS. The cutoff switch is downstream of that. Part of the reason the manual trim wheel could not be moved is the airplane was overspeeding due to being (incorrectly) at full throttle. Overspeeding greatly increases the force on the stabilizer, making it much harder to move. In the EA flight, the overspeed warning horn could be heard on the voice recorder.
  - filleduchaos 1y ago
    The only reason why "making it behave like other 737s" was even a goal to begin with was so that it wouldn't need to undergo more rigorous certification and pilots wouldn't have to undergo comprehensive training to get rated for the 737 MAX. This was very explicitly because pilots _didn't_ need to do that to get rated for the competing A320neo family, not because Airbus did absurd shenanigans to make it handle the same as the A320ceos, but because they weren't desperately holding on to a 1960s design that was amongst other things so low to the ground that the new engines being fitted to it couldn't actually fit. That has nothing to do with actual safety and everything to do with profit. > The 737 has only one electric trim rate - on and off. It does not trim harder or faster than the autopilot trim or the thumb switch trim Is there a reason you cut off the sentence you're quoting before the part that says "than human pilots could MANUALLY trim" and started talking about the electric trim rate instead? Because that part of the sentence was written for a reason - the overwhelmingly more relevant reason why the manual trim wheel would not have saved them is that they would have had to crank it 15 times to trim just one degree (and they were much more than one degree out of trim, due to MCAS activating for five full seconds each time). Even if they weren't already overspeeding, it is highly doubtful that they would have won the battle to keep the aircraft in the air given their proximity to the ground + struggle to keep the nose above the horizon with two pilots versus one. Also mind you by the time they entered the overspeed condition, they had already had the stick shaker going (due to the faulty AoA sensor, with no IAS disagree alert) and had had 2 MCAS activations to deal with, with the autothrottle failing to reduce the thrust to the climb detent because the very same faulty AoA sensor.
anonymars 1y ago
Isn't the fact that it was redesigned (to not rely on a single AoA sensor, to only activate once per AoA-event, to limit the magnitude of intervention) a strong indication that it was badly designed?
wat10000 1y ago
It was implemented exactly as designed.

WalterBright 1y ago

I know this. I also know that there were 3 MCAS incidents. On the first one, the crew restored normal trim with the thumb switches, then turned off the stab trim system. They had no idea that MCAS existed, they simply followed standard procedure for runaway trim. After the first crash, Boeing sent around an Emergency Airworthiness Directive to all MAX pilots with the two steps I showed. There's no excuse for MAX pilots not reading, understanding, and remembering Emergency Airworthiness Directives. It's not just me. I've talked to two 737 pilots who said the same thing.

throwaway5752 1y ago
I see in a sibling comment that you do not think the MCAS system on the MAX was well designed, and the reliance on a single AoA sensor was not a good decision. I agree. The aircraft should have never been declared airworthy. There should have been no need for an EAD in the first place. There is no excuse for putting a control system that flies the craft into the ground when there is a failure in a nonredundant sensor on a commercial aircraft. The high standards required for pilots, like Amelia Earhart, do not obviate the even higher standards for quality and safety from manufacturers.
- WalterBright 1y ago
  I suspect that Boeing didn't think it would be a problem because the runaway stab trim procedure is enough to stop it and recover. Who would have thought that trained pilots would not remember this procedure? It's supposed to be a "memory item", meaning consulting the checklist was not required. The stab trim cutoff switch is in a prominent position on the central console (not overhead or behind the crew). In the first Lion Air crash, the airplane dipped and recovered (via the thumb switches) 25 times over a period of 11 minutes. They never thought to turn off the stab trim system. It boggles the mind. Would you want to fly with a crew that didn't know what the switches on the console were for? Not me. Both Boeing and the crew are at fault. Some percentage also for whoever made the faulty sensor and the failure to see that it worked correctly after it was installed.
  - 1y ago