Hacker News Reader

Comment by manfredo | Hacker News Reader

I've read a variety of articles on this and they often said somewhat different things. What I've been able to gather about the timeline of events is:

1. The new engines on the MAX shifted the center of gravity forward (and I assume center of lift stayed the same).

2. Boeing was worried that #1 would cause the plane to nose up during high angles of attack (so, take off and landing?), and added software, MCAS, to pitch up to counteract this.

3. There's some confusion over when this software kicks in and how to cancel it (something about the trim controls not cancelling MCAS?)

4. Regardless of #3, this software seems to have confused pilots and the current belief is that MCAS was active when pilots didn't want it active.

5. ????

6. Planes crash.

Also, I've read about some concerns about the fact that the handling behavior changed so much but the plane wasn't reclassified as a different type. I'm still unclear about how classifications plays into this story.

My core point of confusion is, if MCAS is the culprit why isn't the solution to remove MCAS? Is tendency to pitch during high angles of attack unusual, and something pilots cannot be expected to counteract manually? I've only played sims like DCS and X-Plane (and not very much at that) but "nose goes up when I don't want it to, so I push stick forward" doesn't seem too complicated to me. Of course, I'm no pilot so I'm probably drastically oversimplifying the situation.

View on HN

Your point #1 is incorrect. The problem with the larger engines is that their larger nacelles placed further forward produce extra lift at high angles of attack. This lift is further forward than the centre of mass. The certification requirement is that to produce steadily increasing angles of attack, you need to steadily increase back pressure on the yoke. The problem with the Max is that this is no longer true. Past a certain angle of attack, the back pressure needed to further increase angle of attack reduces. The plane is not actually unstable, but it's closer to being so than the certification requirements allow. And it's certainly behaviour that Boeing couldn't claim was similar enough to older 737s to allow a common type rating. Hence MCAS, which was supposed to detect this condition and make the aircraft fly like an older 737. This allowed a common type rating, and allowed the aircraft to be certified. But fundamentally, the airframe has an undesirable property, and you'd never have designed it this way unless the desire for a common type rating dominated other design decisions.

It is incredible: the airframe has been designed to reuse the certification of 737. A flaw that could be fixed in a proper way, instead has been worked around using unreliable subterfuges.

The aim of the certification process is to ensure the safety (and reliability) of aircraft. The required mindset shall be that the certification process helps to highlight defects in order to build a better aircraft. Here, the mindset was that the certification process is a burden with arbitrary constraints that have to be fulfilled even if this means a worse aircraft.

IMHO, the people (managers) with the wrong mindset shall be replaced and the faulty airframe of 737 shall be killed.

This is unfair. If done appropriately, making a plane behave the way pilots expect should also make it safer. A "worse aircraft" with a better UI can actually be a safer aircraft.

Only so far as we can assume the UI never breaks and the sensors are always correct. The issue is pilots need to be trained to understand where the UI hides the underlying performance of the plane because when it breaks it can go wrong incredibly quickly. MCAS altered the way to aircraft reacted and also would restart it's changes unless completely cut out. Pilots didn't receive enough training to recognize the issue as being the MCAS system adjusting the trim fast enough to prevent the crashes during takeoff and ultimately the whole point of the MCAS was to avoid having to retrain and maintain the common type rating.

So, I must be missing something but all that re-engineering was to put a larger engine on the airframe but still have ground clearance, while on the ground, correct? What was stopping them from increasing clearance by increasing landing gear height? (And thus not impacting flight characteristics)

They did increase the length of the nose landing gear, which helped a bit. But increasing the length of the main landing gear would have required moving the gear further outboard, as there was no space to extend the gear in an inboard direction when it's stowed. You can't move the gear a lot further out, or it ends up behind the engines. See this picture someone else on this thread posted: https://i.stack.imgur.com/GFzcj.jpg And you really don't want to move the engines further out, because that's going to affect the engine-out behaviour, and require a larger vertical stabilizer to handle asymmetric thrust.

I think that image shows plenty of room. Remember that the tires don't count, because those would be farther away from the wing.

There are other height issues with ground support equipment for luggage, fuel, passengers, maid service, sewage, etc.

Thank you; I've been following this since the second crash and this is the first time I've seen an explanation for why moving the engines forward made the plane unstable at high angles of attack.

> Boeing was worried that #1 would cause the plane to nose up during high angles of attack

Your #2 is flawed. Shifting the center of gravity forward would cause the plane to nose down relative to the older model. The problem is that the engines are more powerful, mounted higher and further forward shifting the point of thrust to a location where the plane would rotate further (nose 'up'), that is why MCAS attempts to push the nose down by trimming the tail plane if it senses the plane to be in a too high angle of attack.

This.

The engines are further away from the plane's fulcrum, and this means that they can now cause the plane to tilt up more efficiently.

From what I read purpose of MCAS is to make stick give same feedback as on 737 NG, i.e. certain linear force increase would correspond to deflection amount on the elevator. With MAX it was no longer true due to air frame geometry and engine changes, and at certain high angles same amount of force applied to stick would result in more deflection. All this had to be maintained in order to not have re-certify all the pilots from NG but be allowed to only give minimal training I think.

We don't even know the real problem, how can we make speculation like this. Every article seems to cite "faulty sensor data", but is this really true? Would making the sensor more reliable or having an additional backup sensor have prevented the issue? Is it possible for the software to even detect when the sensor is faulty? Maybe the sensor worked fine, and the MCAS worked fine, but the plane itself has faulty aerodynamics.

At this point, it seems clear that MCAS had something to do with the crashes, but it's far too early to point to the root cause.

> Would making the sensor more reliable or having an additional backup sensor have prevented the issue? Is it possible for the software to even detect when the sensor is faulty? Maybe the sensor worked fine, and the MCAS worked fine, but the plane itself has faulty aerodynamics.

The sensor on the Lion Air flight was 20 degrees off. While it wouldn't have "prevented the issue", a simple disagree light in the cockpit would have told the pilots that the AOA sensor was "wrong" while they were still on the runway. Simply put, the plane was unfit to fly and had this light been installed on that plane, the flight would have never left the ground and the crash wouldn't have happened.

Boeing charged extra for this light.

Since this has come to light, Boeing have announced that the disagree light will now come as standard on all 737MAX's at no additional cost.

There is no AOA on the ground. it requires airflow. You would not have seen an AOA disagree until the aircraft was in the air or at least moving at a pretty good speed down the runway.

I read that in another heavily upvoted comment on here in an earlier discussion a week or so ago. I really shouldn't assume that randoms on the internet know what they're talking about.

Anyway, thanks for the correction.

To supplement the other comments: http://nrg.cs.ucl.ac.uk/mjh/lionair.png

> From what I read purpose of MCAS is to make stick give same feedback as on 737 NG

No, the MCAS system is not in any way responsible for feedback to the control stick. It engages the stabilizer (tail plane) trim motors based on AOA sensor readings, the state of the autopilot and whether the flaps are engaged or not. It has a limit of 2.5 degrees change but this limit is reset every time the system is reset in effect allowing it to fully deflect the tailplane until the limit stops kick in.

Same thing, surely? Altering the trim means that pulling a certain amount on the stick doesn't make the plane pitch up as much as it would otherwise, hence you need to pull more on the stick (than a plane without MCAS). So the (intended) end effect is the same, right?

Yes. Stick force curve certification compliance is a primary reason for MCAS to exist.

No, because what changes is how far you move the yoke not necessarily how hard you have to pull (on the penultimate Lion Air flight the elevator feel system was non-op which meant that the yokes were probably extremely light for the whole flight). There will also come a point where you cannot overcome the stabilizer with the elevator.

The bit you put between brackets '(intended)' is the key here. What they intended was one thing, what they got was an entirely different thing. The stabilizer being as large as it is and the degree of authority afforded the MCAS system could cause the tail plane to deflect to a degree that the stick could not overcome it at all, the elevators are simply not large enough to counteract a tailplane that is trimmed purposefully the wrong way to the maximum deflection, in part because trimming the tailplane wrong also limits elevator effectiveness.

Yes both points 1 and 2 seem the wrong way round. Presumably the centre of lift has moved relatively further forward than the centre of gravity to create a greater pitch up moment (which apparently exists on older models).

MCAS wasn’t introduced to simplify pilots’ life. It was to make the plane way cheaper overall by avoiding the plane being a different one according to regulations. Regulations that were there to make planes safer to begin with by making sure differently enough planes warrant training, processes, reviews, etc.

Sadly, MCAS introduced unintended side-effects and is not as transparent as it was supposed to be, from what looks like.

Therefore, if you remove MCAS, the plane should be easier to predict; but who knows what that implies now that the plane has been sold and flying for a lot of time (financially, legally...).

> if you remove MCAS, the plane should be easier to predict

And the prediction is: the plane would then not pass the "is it safe?" tests which don't exist "just so" but to make sure that the plane can avoid to crash as soon as something small and insignificant happens.

Without the MCAS the input from the pilot would lead to plane failing easier in higher angles of attack. The MCAS was added to avoid that. So MCAS should work and should not have a single point of failure, as long as 737 MAX flies. MAX is indeed less stable in higher angles of attack.

All Boeing claims "they can simply turn it off" are misleading. The plane is actually more dangerous without properly functioning MCAS. But to properly function the sensors have to be redundant and reliable, and the control that activates it too. And the control software which deactivates it should also be smart enough that "activate/deactivate" cycle isn't itself the crash cause, which is what it looks like was what directly caused the last two crashes:

- the sensor used was only one, i.e. was not redundant.

- the control software blindly trusted it.

- the software, apart from blindly trusting the input of the sensor, was not even properly tested in the condition of the faulty sensor, specifically, the impact on the pilots.

- the whole feature of MCAS was intentionally downplayed, and even hidden initially, to hide the fact that the pilots would have to train for the conditions in which MCAS fails (it can happen, as it at the end depends on mechanical and computer devices) -- the pilots have to be trained to "save" the plane without MCAS functioning, even if the plane is less stable. Note: MCAS should properly function as much as possible to minimize the chance for any small error causing big crash, but in the case when MCAS is not functioning the pilot still has the chance to save the plane only if he is trained exactly in the simulator which simulates the plane with no MCAS (when the controls don't behave "normally", which is what MCAS provides when working). That kind of training was not made at all because the selling point of MAX was "it's the same old, no need to pay for pilot's training." (Or maybe, then the pilots would know that the chance to save the plane was so reduced that they would complain more about the overall plane design?)

- the decision to "just let pilot turn it off" was based on the false assumption that the faulty MCAS behavior is "obvious" to the pilots so that they turn it off easily.

All that was not implemented in Boeing 737 MAX.

By the way, the sensor looks like this:

https://aviation.stackexchange.com/questions/2317/how-does-a...

And the need for the redundancy was commonly known also before the crash:

"The AOA values are never averaged. Depending on the AOA computer, logic is used to determine if one of the vanes is giving bad data"

On further investigation, it seems #3 is more: MCAS had much more control authority (i.e. was allowed to change control inputs from the pilots by more) than the FAA had approved.

#5 is: a fault in a single, non-redundant sensor could cause the MCAS system to falsely believe the plane was stalling, and push the nose down as hard as it could. Which (see above) was harder than a pilot could override by just pulling in the other direction, as is apparently intuitive for them.

I've always been confused here on this, does that mean the 737 MAX has a high chance to have faulty reading from their AoA sensors? Or is that pretty much the industry standard right now? This has always seem like the actual culprit.

Sensors break. They get gunk on them. They ice over.

Generally a sensor with such a critical failure mode would be triple-redundant - if one fails, the discrepancy between sensors is flagged and the aircraft runs on the other two until the broken one is fixed. In this case, the aircraft had two sensors of the type (Angle-of-Attack), but MCAS was only listening to one of them.

Thanks for the elaboration. Could you help me further understand one more thing? When you say MCAS only listens to one, does that mean during the time when one AoA sensor fails? Or it always listens to one during normal operation?

Also, it does seem like Boeing dropped the ball here to not build further redundancy here.

MCAS alternates between the left and right sensor each time the plane lands. With the Lion Air flight I think cycling the electrical power for diagnostic work caused MCAS to pick up the faulty sensor for two flights in a row.

That actually sounds awful, sorry for my naivety if this is just industry standard. But for such a mission critical piece to have no redundancy build over it is just poor. Especially that it's prone to failure since it's situated on the outside of the plane.

It just seems to be that this is some terrible engineering done on Boeing's end of not fully understanding the critical situation here.

Generally two failures: 1. a lack of redundancy in a mission critical sensor 2. a blind trust on MCAS's priority over pilots

a lack of redundancy in a mission critical sensor

There is redundancy in the sensors, but the sensors are not being used in a redundant manner. There are whispers that the 767 fuel tanker (KC-46/KC-767) has a system similar to MCAS that will look at both alpha vanes for disagreement, which is a bit damning to say the least.

a blind trust on MCAS's priority over pilots

The entire purpose of MCAS is to engage only when the pilot is flying to prevent the pilot from doing something dangerous. Previous generations of 737 had the same problem but the MAX is more delicate and compounds it with nacelles that generate lift.

Part of the problem was that MCAS was originally designed with very little control authority, and so wasn't considered safety-critical. However, during testing they realized they needed to up the gain, and made pretty major retuning without reexamining their safety assumptions.

Plus the bug with the resets on the limiter.

I believe the MCAS uses the pilot-side sensor.

> MCAS alternates between the left and right sensor each time the plane lands

This sounds like spectacularly bad design that manages to extract negative value from having two sensors. What is the logic behind this?

Pilots and first officers tend to switch who has flight control on each leg of their flights (which is the Pilot Flying vs Pilot Assisting), and the MCAS system uses the AoA vane associated with the side of the cockpit that currently has flight control.

There is no good reason for only listening to one sensor.

There is a sort of good reason for having a split between pilot/copilot side: the instruments are redundant (both physically and electrically), so in the event of malfunction you can failover to the other side.

Boeing dropped the ball in many, many ways.

The lack of redundancy by default coupled with extreme profit seeking by Boeing for the 'upgrade' is inexcusable. TL;DR They shit out a faulty product hundreds died as a result

How does this AoA sensor works? I'm guessing it has to sense the direction of the wind and then calculate the vector of the wings compared to that?

I've seen pictures of it ( https://aviation.stackexchange.com/questions/2317/how-does-a... ) and seems to be a simple mechanical component.

Why isn't this compounded with something that works by estimating the AoA from other factors? A few simple gravity based sensors would be able to tell the vector of the plane, and simply assuming that wind (airflow) is parallel to the ground would go a long way. Or is the vertical component of the local airflow so variable?

When in flight, accelerometers only tell you what forces are being exerted by the wings and the engines, not which way is down. Consider, for example, the way the drinks in a cup don't spill when a plane turns.

I know that an airplane can make a roll that keeps the fluid in the cup, but when usual commercial planes fly, they don't do stunts, so usually there's no centrifugal force to mimic gravity. When a big jet points its nose down or up people and fluids feel it pretty much as if they were on the ground on a slanted flat surface as one of its edge is being raised or lowered.

Sure, this would probably worth next to nothing in turbulence, but in a simple take off and landing (where MCAS is already active and depends on AoA) it might help.

And of course I might be completely ignorant of most of the relevant problems with using any kind of gyroscopic or acceleration based sensor.

Why isn't this compounded with something that works by estimating the AoA from other factors?

Cost, probably. The 777 and 787 still only use two alpha vanes, but they calculate a synthetic angle-of-attack value as well.

I think general relativity rules out the possibility of making a gravity detector that can distinguish it from acceleration.

No, but cost probably does. There have been a number of satellites flown (GOCE, GRACE, SLATS) with the sort of equipment you'd need. With that equipment, simply measure the strength of gravity in multiple parts of the plane. This gets you altitude, just as GPS or air pressure would, and then you can determine the angle of the plane.

An edit as response to the followup mentioning Einstein, due to HN throttle:

Yes, yes... and it doesn't matter for this purpose, because you can measure gravity at multiple points within the aircraft and because gravity falls off with distance.

https://en.wikipedia.org/wiki/Inverse-square_law#Gravitation

We have built equipment sensitive enough to measure this difference and we have flown it in satellites.

"Einstein’s ground-breaking realization (which he called “the happiest thought of my life”) was that gravity is in reality not a force at all, but is indistinguishable from, and in fact the same thing as, acceleration, an idea he called the “principle of equivalence”.

https://www.physicsoftheuniverse.com/topics_relativity_gravi...

> Or is that pretty much the industry standard right now

Half the industry uses three or four AoA sensors with majority voting.

The other half ( Boeing ) uses two.

Even redundancy doesn't really solve the issue. The sensors are out in the same environmental conditions, so will likely all fail at once, for example a bad pattern of water followed by cold causing icing.

Instead, the sensors should detect failure, for example by using a motor to detect if the vane is stuck and cannot turn freely.

The flight controls should also be able to fly even if all sensors of a certain type have failled. Angle of attack for example can be approximated with an accelerometer and gyro well enough to keep the plane in the air.

>Angle of attack for example can be approximated with an accelerometer and gyro

I'm prepared to be wrong but that sounds impossible to me. A steady-state descending stall is inertially indistinguishable from cruise.

You're right - you need to combine with altimeter or GPS, and for more accuracy you can also combine with wind direction forecasts or airspeed measurements.

The point is, there are lots of data sources, and with even a subset of them, it's possible to fly the plane to a safe landing.

But then the motor could break, and so it goes. The more moving parts around you have, the more failure modes you have.

If the motor breaks, the sensor has failed.

Failure isn't really the problem - it's silent failure which is deadly.

It's tangential but when I read those comments saying that a system could effectively override a pilot, by putting a feedback beyind human strength on a critical control, I always think how enormous kudos is owed to the experienced badass that flew the plane before, during critical situation figured out he knew better and tirned it off.

The thing about the 737 is that you have massively powerful engines essentially hanging from the underside of the wings, and the wings are in a low-wing configuration (i.e. they sprout from the bottom of the fuselage and not the top like a Cessna).

Imagine you're on final into a busy airport and you have to abort your descent because $reasons. If you slam the throttles forward, the thrust is all below the aerodynamic centre of the aircraft, so you have a net nose-up pitching moment created. In other words, when you slam the throttles forward the aircraft tends to nose up. A 737 pilot told me recently that in a take-off/go-around situation you actually need to push the yoke forward to restrain the aircraft's nose-up tendency until you can re-trim for climb.

MCAS was introduced because the new engines on the MAX, essentially, make the airframe more dangerous at high Angle of Attack than the previous generations of the 737, and so MCAS was intended to automagically keep pilots from entering the dangerous regime.

MCAS was required in order to keep to the "zero training delta" commitment. The solution might be removing MCAS, but that will/would require more pilot training which would essentially render the MAX a completely new aircraft as far as regulation is concerned.

> the thrust is all below the aerodynamic centre of the aircraft

Just like 95% of airliners. In fact the Max engine thrust line is higher and closer to the datum than most.

The Max's problem is not thrust line, it is additional lift generated by the forward-mounted engine nacelles at high AoA which reduces stick-load and makes pitch-up to a stall likely. Nothing to do with thrust.

>Just like 95% of airliners. In fact the Max engine thrust line is higher and closer to the datum than most.

Correct.

>The Max's problem is not thrust line, it is additional lift generated by the forward-mounted engine nacelles at high AoA which reduces stick-load and makes pitch-up to a stall likely. Nothing to do with thrust.

Nothing you've written here contradicts what I wrote previously, so I'm not sure if you're just aggressively agreeing with me, but I'll assume that this is the case. Yes, the aircraft is dangerous at high AoA, as I wrote in my previous comment.

Is it the ammount of lift of the nacelles or the forward position of this extra lift?

Both: the position changed because the size changed.

Pitching up on thrust was a problem with the 737 Classic, why wouldn't it be a problem on the MAX?

MCAS operates on the horizontal stabilizer (and is not a stick pusher like the article claims) the yoke operates on the elevators. The elevators are much smaller and lack the pitch authority of the stabilizer. The stabilizer moves much slower and by the time you've stalled under the conditions MCAS is designed to prevent, you may not have time for the stabilizer to move.

> MCAS operates on the horizontal stabilizer (and is not a stick pusher like the article claims) the yoke operates on the elevators.

https://en.wikipedia.org/wiki/Stabilizer_(aeronautics)#/medi...

So the issue is that MCAS was controlling the big control surfaces, the pilots' attempts to correct with yoke input operated on the small control surfaces? The former overpowered the latter.

Interesting that MCAS wasn't like cruise control where any significant input deactivates the automated controls. But then again, I know next to nothing about how big airliner control systems work.

> Interesting that MCAS wasn't like cruise control where any significant input deactivates the automated controls.

It would disengage... but then would immediately re-engage if the bad sensor readings were still there. And would, in the meanwhile, have reset its control limiter so it would push even harder than the first time.

Also thanks to "zero training delta" commitment pilots probably didn't even know it exists or in a high-stress situation like imminent stall probably just forgot about it all.

It's worse: the pilots are supposed to "jump in" instead of the software when the plane is typically already in the critical state and then to control the plane which behaves exactly differently from the way they are trained. Only when the MCAS operates "properly" the plane behaves as they were trained!

That "omission" was intentional as the Boeing selling point was "it is the same old, no new pilot training needed." That's how they have "sold" the worth of 600 billion dollars of the MAX planes!

The probable strategy for Boeing was "we will blame the pilots" and had the two crashes not happened so fast one after another they would have probably got away with it!

They're supposed to jump in and resolve the problem within forty seconds apparently. Otherwise they're screwed[1].

Those involved in the testing hadn’t fully understood just how powerful the system was until they flew the plane on a 737 Max simulator, according to the two people.

1: https://www.nytimes.com/2019/03/25/business/boeing-simulatio...

The 40 seconds is misleading. The MCAS system could in the worst case run the trim full nose down in 40 seconds (it's active for 10 seconds with a 5 second delay between cycles) if the pilot does nothing to counter it.

It's like if you are driving and the road starts to curve. If you do nothing, yes you will get to a point where a crash is unavoidable. But you know that when your car is not following the road, you turn the steering wheel. Pilots know that when they have to pull the yoke to keep the plane level, they need to trim.

The problem is that if you do the intuitive thing (which is what pilots are trained to do for most trim overruns - pull on the stick to counter the trim), the MCAS goes through the increasing cycle to full nose-down. It's 40 seconds to realize that your usual strategy isn't working, figure out what to actually do, and then turn off the exact right system.

From what I have understood they used MCAS so that they didn't need to reclassify the plane model and that pilots would not need to retrain for it as with the MCAS the handling would be similar to the older planes. The actual problem might not be with the design but using workarounds to get through red tape of reclassifying and retraining pilots for a new plane

Wasn't the idea that they wanted to avoid pilot re-training? So if pilots would be expected to counteract manually, they would have to train to understand when to do that.

Pilots are already trained to handle runaway trim, the idea was that an MCAS failure would behave similarly and the same checklist they already trained on could be used. Due to issues in how MCAS was implemented however, the behavior was different from runaway trim and more confusing.

One comment I saw was that with Boeing aircraft when the autopilot is off you're fully manual. Unlike Airbus.

MCAS has control authority when the autopilot is _off_.

> with Boeing aircraft when the autopilot is off you're fully manual

The 777 and 787 are full-time FBW, there is no manual reversion. There is no way to move the control surfaces directly. The only difference with the AP engaged is the origin of the control demands.

You can have cables, push rods, hydraulics, power assisted hydraulics, full hydraulic, and electrical actuators. As long as their control inputs are only from the pilot they are identical in every way but their failure modes.

There is big big difference between FBW and the aircraft generating control inputs on it's own. Boeing aircraft had two modes, 'manual' and 'auto pilot' The 737 MAX adds a third case, 'sometimes'

Boeing never told the pilots about the 'sometimes' part. And never told them that 'sometimes' has ultimately more control authority than they do.

I think you misunderstood my post. There is literally NO manual command over control surfaces in any current Boeing airliner other than the 737 variants. Neither the 777 nor 787 have any pushrods or cables.

The Max does indeed have a hybrid approach ( manual actuation, FBW spoilers, mystery MCAS ) but that's not Boeing's current philosophy.

You're willfully failing to get my point.

From what I've read, MCAS is disabled with the flaps down, so it wouldn't be for take-off and landing.

Because:

1. earlier 737 models didn't pitch up and Boeing wanted the plane to "feel" the same and not have to re-train the pilots

2. there is some certification requirement that the pitch has to be constant during climb (or something like this); if the plane doesn't have this, it is not certified to fly. It wouldn't pass FAA certification without MCAS.

> there is some certification requirement that the pitch has to be constant during climb (or something like this); if the plane doesn't have this, it is not certified to fly. It wouldn't pass FAA certification without MCAS.

So what I gather is the issue was that the MAX didn't fit this requirement for steady pitch (hence the airframe problem referenced in the linked article), and MCAS was supposed to be the band-aid to fix this essentially by automatically pushing forward on the yoke during high angle of attack.

If that's the case then the following is especially concerning:

> Boeing offered the single angle-of-attack sensor as standard equipment, and charged extra for a second along with a “disagree” indicator that would allow 737 MAX pilots to “cross-check” a faulty sensor.

Seems pretty sketchy to ask airlines to cough up extra dough for redundancy on a safety critical system. Who knows what other systems are subject to the same cost/benefit tradeoffs.

Boeing offered the single angle-of-attack sensor as standard equipment, and charged extra for a second along with a “disagree” indicator that would allow 737 MAX pilots to “cross-check” a faulty sensor.

Yeah, that's factually incorrect. All 737 NG/MAX planes have two alpha vanes to detect the angle-of-attack. MCAS only ever uses one at a time.

Edit: You can see them both plainly in pictures:

https://www.planespotters.net/photo/806268/pk-lqg-lion-air-b...

https://www.jetphotos.com/photo/8686917

If MCAS is required for the plane to be airworthy, then it is not airworthy when the pilot disables it via stabilizer trim cutoff. And if the behavior of the plane is not subtly different in approach to stall, stall, or stall recovery, then the pilot might also not be type certified for the airplane with MCAS disabled.

I'm really suspicious, in a variety of ways, of cutoff switches effectively decertifying a plane in flight. And then how it's OK for pilots to not at least be made aware of that potential situation in advance?

An airplane suddenly rendered not airworthy, and pilot suddenly rendered without a proper type rating. It's absurd. I don't know how a software update gets them out of this predicament, if it's true.

Airbus fly-by-wire aircraft have numerous layers of safeguards (laws) in place. Each can be removed or degraded depending on the circumstances. But pilots are expected to know all of them, and know the consequences of each safeguard being removed, including the ensuing natural flight behavior of the airplane.

Anyway the story still isn't fully out yet.

From the article.

That design decision meant the 737 MAX would tend to pitch up while accelerating.

So the MCAS was there to counter that behaviour by automatically pushing the nose down when it detected this nose up situation.

There's also the issue of the "faulty sensor". We don't yet know if the sensor was faulty, but if it was, whether MCAS could have detected that fault.

I'm really curious what the Software QA process is like at a company like this (or any company where automation failure can result in loss of life).

From comments I've read, abysmal, in the sense the Quality people are told they aren't there to keep the plane from falling out of the sky, but rather to generate audit trail so that if a disaster happens, the cause is traceable.

My personal approach to Software QA is generally more in line with the role fulfilled by a Systems Engineer, so I'm intensely uncomfortable having read Quality may be culturally interpreted in such a perverse manner.

Funny thing about Quality is you find exactly what you look for. Start out making a system that only suffers traceable disasters, and you get a different product than one which focuses on not suffering disasters in the first place.

I don’t have an aeronautical background at all, but a hunch I heard from some aviation forum is that the plane must be certified to be safe when flown by merely an “average” pilot, and if the Max was more difficult because it had this tendency to stall, that might mean it needs a pilot with more skill, therefore more training for existing 737 pilots. So MCAS was needed to ensure no skill difference or training difference whatsoever for the pilots, even if a typical pilot should be capable of flying without MCAS.

Is the reason they moved the engines forward to avoid having to lift the plane higher and not having it fit jetways/stairs?

The CFM Leap-1B (new engine on 737 Max) are bigger than the CFM56-7B, so Boeing had to change the mounting point of the engine (further forward and higher on the wings).

Right, but why didn't they just lift the aircraft higher off the ground to fit the larger engines.

Because they couldn't fit larger landing gear.

Because the gear has to be stowed!

The gear is retracted inboard, so lengthening was a non starter given the rapidly escalating hardware changes that would be required to the gear bays.

Once you start changing the fundamental structure of the air raft, you also start weakening your case for a common type certificate as well.

#5 The answer is: The aircraft stalls

Reply on news.ycombinator.com