Comment by ajross | Hacker News Reader

Comment by ajross | Hacker News Reader

Boeing's design process was a shady mess for sure, but safety goes all the way down and up the stack. Every failure mode should have some level of redundancy and double checking.

So, yeah, a manufacturer tried to game the certification process to save a few bucks (and months) on a new aircraft design. That's a failure. But it's not an unforseen one!

The safety value for manufacturer shenannigans is supposed to have been the certification process itself. And I gotta say the worst failings here are with the FAA. At any point someone could have looked at the process and seen:

1. They changed the engine

2. They had to move it because it was too close to the ground, but they couldn't stretch the landing gear and keep the type certification.

3. So they moved the engines forward and up

4. But now the aircraft was less stable, and they couldn't change the tail design and keep the type certification.

5. So they did software-managed stability augmentation instead

6. But (that's right) they couldn't change the autopilot and keep the type certification.

7. So they did it with the trim, which had never operated under autonomous control before.

I'm sure I have a few of those details wrong, but the point is that any bureaucrat familiar with the aircraft could have seen that this was a ridiculous house of cards they were playing with the type certificate. I mean, one change with one workaround, sure. But a cascade like this is just obviously a perversion of the process.

Yet no one said something. Or if they did they were overruled.

The way the built-in incentives work, it's not feasible to rely on 100% forthright and honorable manufacturers. So we have a regulatory body to catch those failures for us, and it failed.

I think this also reflects that Boeing has moved from being a honorable company where good engineering was the first priority, to a company driven by greedy MBAs and PowerPoint charlatans. Those crazy ways to bypass regulations indicate they were totally pushed by a business plan that did not mind cutting lots of security corners.

It's sad, but I think many corporations, and in general most human organizations, go through this lifecycle.

Obviously, none of this discharges FAA from all the very likely negligences they committed when reviewing the new MAX certification you have explained so well.

It also means that they have competition: airlines are not fond of having to recertify their pilots and "flys like any old 737" was Boeing's main advantage over less outdated Airbus designs. Doing the engine replacement the right way would have created a pilot recertification requirement and thus canceled that advantage, no matter how much money Boeing threw at it. As much as I enjoy a good game of MBA-blaming, "fake it till you break it" is more than simple cost-cutting here. There's just as much engineering hybris at play when "can we do it? yes!" is heard while "should we do it? no" is hardly ever thought (same with diesel and urea tank refills). I see the problem more in institutionalized optimism than in penny-pinching.

If I google the term "PowerPoint charlatan", I only get one or two relevant results. I'm a fan of this term, is something you've heard used before?

I've heard a slightly different construction in Spanish and French. Namely, PowerPointista to denote people talking nonsense and handwaving.

> And I gotta say the worst failings here are with the FAA.

The FAA is underfunded to do their job properly. The major consequence of this is that to properly certify the changes from Boeing would have taken a long time. A long time would mean that Airbus would win more contracts compared to Boeing. With a pro-business administration in place, there was significant pressure put on the FAA to complete the certification quickly. They were actively encouraged to outsource safety work back to Boeing's engineers to keep pace on the timeline.

>The FAA is underfunded to do their job properly.

That's not an excuse to rubber stamp a design.

Totally agree, and that's not what happened. Some of the data that Boeing presented to the FAA was wrong/old.

it received its type cert on 8 march 2017. trump took office less than two months prior. i HIGHLY doubt the process happened entirely within that ~ 1.5 months.

To be clear, I'm not pointing fingers at any particular politics. American government in general is pro-business. That's both good and bad, and this happens to be an example of pro-business policy outweighing safety policy.

> With a pro-business administration in place

The ODA program, devolving certification work to industry, started in 2007 and followed an earlier trial called DSA.

Cessna has full type self-certification authority, too, but seem to behave responsibly. Perhaps because the bizjet market is truly competitive and if they are caught taking shortcuts then EMBRAER, Dassault, Raytheon, Bombardier etc will take their customers.

Whereas if an airline cancels their 737 Max now, they'll be waiting eight years for an A320Neo

Sounds familiar. I am in medical devices and we often have situations where the technically correct thing would cause a huge amount of paperwork and FDA scrutiny so we look for ways to work around this. This can mean a technically inferior solution but it's more viable from a financial and time to market point of view.

It's a weird balance.

The game is set up such that these quandaries are inevitable. This is a problem with capitalism and competitive markets. People bemoan the process and demonize those that have to balance financial pressure against other forces but the truth is, the result often goes unnoticed. We are all use to getting less than desirable results on a daily basis; it is just when a catastrophic failure occurs that we all start calling out from our soap boxes about how we should do better.

Aside, we all know safety and security are important, but we complain the other way too. How many people complain about how much we spend on defense as a country? The budget is reflective of the number of ways we need to defend ourselves and the number of ways we would need to overcome an adversary's defenses when we are on the offensive. That number grows as technology gets more advanced. The people involved in developing solutions are increasingly more specialized and salaries are getting higher. If we did nothing, somebody might drop a bomb on our head and we'd all wonder why we never spent money developing a defense.

TLDR: The world is funny and people complain about everything.

As a passenger, if these were the trade-offs Boeing made, my stomach just dropped. I don’t consider myself naive as to which trade offs corporations might consider fair game to increase profits, but if,,, changing engine placement in spite of impact to stability and such.... can anyone else talk to this. I’m actually bothered by this. This sounds like dangerous engineering.

Everything in engineering is a trade off. The changes that were made were not inherently dangerous, but the certification process on those changes fell apart for a variety of reasons. If the certification process had been followed correctly, these planes would be flying safely.

The FAA is underfunded. A pro-business administration applied pressure to help Boeing certify more rapidly. Due to time and money pressures, many things that should have been performed by the FAA safety inspectors were actually performed by Boeing engineers. The safety assessment was performed on incorrect numbers! (Boeing estimated some parameters and performed safety assessment. Then those parameters were updated after flight testing, but the safety assessment was not re-performed with the updated numbers! That's a huge problem in the process.)

> Everything in engineering is a trade off.

A trade off too far is real a thing.

> The changes that were made were not inherently dangerous

A few hundred dead people and hundreds of grounded planes say no to this.

> The FAA is underfunded.

This is a feature not a bug. Under the neoliberal orthodoxy this is as things should be. The free market is the most effective and efficient way to regulate corporations. The FDA is a drain on the economy.

It's not, really. Not technically. All of those tradeoffs and vastly more are made all the time, when certifying a new aircraft.

There's nothing wrong with relaxed stability, autopilots are 60 year old technology and have been keeping people safe since our grandparents were flying. And the certification process has for the most part produced very safe aircraft.

But in this case, the certification process was seen as too expensive. Boeing wanted to market a tweaked, high-efficiency 737 with newer engines, and didn't have the time to spend on certifying a whole new aircraft. So it used the same old one and the faster regulatory process.

But that assumes that the regulatory process worked. Clearly that cascade of changes was not in the spirit of "just small modifications to existing designs". But the FAA didn't squawk and certified it anyway.

And as it happened, just one of those choices (using the trim for stability control) turned out to be unsafe in unexpected ways. One was that the AoA sensor driving the thing was glitchy. But more importantly, the trim was originally certified on the assumption that a trim control failure could be overridden by the pilot, but no one realized that pilots weren't trained to think of trim as being a computer controlled thing and didn't understand what was happening when the MCAS started fighting them.

> But in this case, the certification process was seen as too expensive.

Not just that, but also pilots would need new training if it were a new type certificate. This was a huge marketing advantage for Boeing because their end customers could avoid the cost of re-training their pilots on a new airplane.

And the lives lost an unforeseen externality. One would hope a company in such a safety critical industry would err on the side of caution. Or are they so strapped for cash they can't afford it?

> they couldn't stretch the landing gear and keep the type certification.

They couldn't stretch the main gear because then it could not have properly retracted into the fuselage. They were able to extend the nose gear a few inches and still allow it to retract.

Point 7 is incorrect. Automatic trim adjustments by the Speed Trim System (STS) had been in place for a long time. However using automatic trim changes during manual flight to reduce a pitch-up tendency near the stall was new.

Reply on news.ycombinator.com