Boeing Engineers Lost Control of the Company

To play devil's advocate, this isn't a moral statement. The author is saying this is true based on actual events.

At the fundamental level, Engineering is a social/ethical process, not a technical one. Yes, engineers tend to have technical skills but when you use those skills to design a bridge you must always keep society (the users of your product) at the forefront of your mind. What separates engineers from "skilled people" is professional ethics. An engineer (structural, software, aerospace, chemical or whatever) who does not consider the ethics of their work cannot credibly claim to be an engineer at all.

To "put the moralism and ethics in its own paragraph" is to sequester the ethical considerations somewhere where they can be conveniently ignored in service of the cult of CEO worship.

edit: Instead of anonymous downvotes, would anyone care to let me know why they find this comment so inappropriate for HN?

When you are in senior management, you make decisions based on their overall effect on the company's financial health or future growth. That is your job, just like it is the engineer's job to make decisions based on overall safety and reliability or future capability.

The debate, or perhaps the proof, is what happens next. Every decision, engineering or management, needs to be evaluated post implementation to evaluate its effectiveness. Are we better off financially? Are we more capable? Is this system more reliable? Is this system easier to change while continuing to validate it is meeting its design goals?

Both management and engineering resist having their decisions "colored" by their negative impact from the "other" group. Engineers don't like it when their clearly correct decision is overridden by management's feeling it doesn't make "business" sense (which is usually code for it reduces margins unacceptably). And management doesn't like it when their decision is negated by engineering telling them it will cause their products to become unacceptably unreliable or unsafe.

In a properly functioning company it is the role of executive management to combine both the needs of engineering and the needs of the business into an effective outcome that everyone can live with and keeps the company alive.

Articles on the acquisition suggest that Boeing acquired MD both because the industry was consolidating and because MD was making more money per plane than Boeing was. They wanted both the customer base of MD and the "DNA" or managerial understanding of how to build planes that were more profitable. Here in hindsight the implication is that the additional profit margin came from skimping on safety and reliability engineering.

At some point, there was no doubt a review on the 737-MAX, where the engineering teams raised concerns about MCAS and the impact on safety and reliability. And the costs associated with addressing those concerns were also discussed, both cost to implement and time to market costs. The result of that review was to pursue certification on their plan of record and to not incur the additional certification and time to market costs that engineering advocated were needed.

That decision was explicitly the pursuit of profit margin at the expense of product safety and reliability. As human lives are transitively related to safety and reliability of the aircraft, it is a reasonable statement to make about pursuing profit at the expense of human lives. That is what the equations reduce to.

[1] https://en.m.wikipedia.org/wiki/Triangle_Shirtwaist_Factory_...

Moving it to a later part of the text is a great way to get people to ignore it.

Boeing started said consolidation itself by having McDD buy it Boeing with Boeing's money.

Anywho, the thing that was interesting to me was how much Toyota and BMW were willing to invest in what is more or less an engineer's bootcamp- like baseball teams playing out-of-league teams in practice to get better- and that that was seen as a worthy investment by the engineering team's superiors.

Some companies still value engineers. That's where I want to be.

Now finally that China starts being too expensive, once investors will realize it is complicated and costly to outsource to Vietnam, India or African countries, I hope this effort will resume.

I wish Mr. Stoller took more time on this:

> The Federal Aviation Administration, having outsourced much of its own regulatory capacity to Boeing, didn’t know what was going on, and Boeing didn’t tell airlines and pilots about the new and crucial safety procedures.

This seems like big deal to me.

> The key decision was, rather than fix the fundamental aerodynamic control problems caused by the new engine, to bandaid the existing 737 software, while pretending that flying the 737 Max was just like flying old ones. That way, airlines would be able to buy the plane and not have to retrain their pilots, as pilots must be re-certified any changed flight procedures but don’t have to be recertified for new models with unchanged flying qualities. Unfortunately, the aerodynamics of the 737 body didn’t fit with the Max’s bulkier engine, which was obvious during the first wind tunnel tests.

The product plummeted soon after, product market fit got lost as the direction became more and more political and by the end, the ones that came out on top and ready to move to their next venture were the managers that managed to tick their measurements and KPIs even though they were totally disconnected from the operational space.

But, they do wield weapons that us engineers often don’t have the time not desire to sharpen...

Furthermore, the author also gets a number of things wrong about his research, and also presents statements as pure fact which are purely false.

Here are three examples I pulled out—in order from minor to argument-disqualifying.

1. The author cites innovation on the 787 as having electrically operated systems in place of hydraulics. He meant to say pneumatics. The 787 does not have an engine air-bleed system, using solid state electric systems to power the aforementioned components instead of the system of valves and ducts which manage the flow of high pressure air coming off the engine, as is the norm on other aircraft.

2. The author sites engines being outsourced historically because of a natural difference in engineering expertise between engine and airframe. While engine and airframe engineering are different domains, the real reason airframe manufacturers don’t make engines and vise-versa is entirely due to the Air Mail Act of 1934. I suggest the OP research the United Aircraft and Transport Corporation.

3. The OP’s central argument of cost control, and particularly outsourcing, as being a central driver to engineering problems with the MAX is hindered when he cites example and supporting arguments primarily about the 787 program.

Yes, cost control is an overarching issue and one that is being investigated vigorously, and 787’s level of airframe outsourcing has been a key problem to that particular program’s profitability.

However, the author fails to understand that the outsourcing he talks about is made at the program level. Citing the 787 as being representative of Boeing as a whole is spurious. The author also fails to understand how outsourcing effects engineering both at Boeing and down the supply chain.

In truth, the level of outsourcing on the MAX is largely no different than on the NG. (The previous model 737 that has been flying safely for decades, which went into service 2 years before the MD-Boeing merger.) It has been common since the advent of the jet age for there to be separate suppliers for engines and components—i.e landing gear or avionics. This does not mean innovation and engineering expertise is past over the fence—-airplanes are in fact built on strong partnerships between firms, and that includes partnerships between engineers. This has always been how the industry works.

Now, tying this back to my 3rd example: The 787 supply chain problems the OP sites are in regards to final assembly of fuselage and wing structures — this is a specific area in which one could argue the 787 went overboard in outsourcing. This, of course, has nothing to do with MCAS—a piece of flight control software—nor the AOA vanes that feed it. Flight control systems, sensors, and vanes are typically outsourced, as they are on the 777, 767, 777, and 747 (all of which engineered and built before the merger.)

...

If we really want to add value to the conversation about Boeing’s culture, the 737 MAX, and engineering aircraft—then let’s please build some knowledge first about how aircraft systems are actually engineered.

Disclaiming that nothing can be definitively said about the MCAS crashes until all the investigations are complete and known, I strongly believe the issue is not a software failure but a systems failure, and particularly, a failure in the management of the safety classification and assessment process.

There is also the matter that the 737 is a very old program. Beyond the argument that it was a mistake to try to modernize a 1967 design and architecture a 3rd time, there is also the problem that the 737MAX doesn’t necessarily adhere to current engineering standards for safety assessment—especially at the systems level. This is because the 737MAX was engineered under the authority of the original 737 certification.

For aerospace engineers working in industry, it would be useful to map what we know about MCAS and the 737MAX against the requirements outlined in DO-178C and, especially, ARP-4754. Unfortunately, the 737MAX doesn’t subscribe fully to ARP-4754 methodology, since it’s a continuation of the program certified in 1967 and not a new type.

Why deliberately untrained? Because the whole selling point of the design was that you wouldn't have to retrain your pilots because it would handle just like the old plane.

It's simply crazy. The only plausible explanation is that Boeing did not perceive MCAS to be safety critical, even though it had control of the aircraft, and so they didn't bother to apply any redundancy to it. Boeing seemed to wrongly assume that any failure modes would appear as a runaway trim.

> That's commonly said about the Apple-NeXT acquisition too — NeXT paid a negative $429 million to take over Apple. (...)

I guess that is why it is considered a joke. It sounds like the management teams of NeXT / McDonnell Douglas benefited much more (in the long term) than the investors of their defunct, purchased companies. Benefiting through greater compensation and clout without really taking over (i.e. owning) the purchasor's company.

I believe the issue is precisely this - the engines were moved (and they are bigger so more powerful perhaps?) forward and the thrust probably pushes the nose up.

If you move CofG forward, and up you move the balance point forward and up, reduce elevator authority, and with similar tail mass now a metre or two further behind the balance point, it will want to sit tail-heavy. So they tried to trim it out, and we are where we are.

Making the engine more powerful (as is the case here) means there will likely be more pitching up moment (turning about the aerodynamic centre or AC) due to the position of the engine relative to the AC. Speaking of which, there is an AC, an aerodynamic centre that is separate from the center of gravity. It represents the point about which the plane pitchs up/down when a force is exerted on it.

Not only is the engine more powerful, but the different position it was placed in (forward primarily) would also create a different force about the AC, and change the forces the other parts apply to the plane (by moving the AC and CG).

There might have been more to it but even a few months after really diving into this the details are getting fuzzy... plane stability dynamics can vary greatly.

Think of it like attaching an extra conditional lifting surface to the wing. In normal, low AoA flight, no pressure differential is created. At high AoA though, that extra lift works through the lever arm of the nacelle assembly.

Control feelwise, this would result in a slackening of control force needed to yield more degrees AoAby the plane after a certain point. That's a regulatory no-no.

For whatever reason, the basic facts of this whole debacle are consistently wrong in reporting and discussion. Common falsehoods:

* The 737MAX is inherently unstable. No, it is a stable aircraft as required by FAA regulation that all passenger aircraft be as such. Nothing about the airframe or design is even that remarkable, beyond the simple fact that it is different from the older models.

* MCAS is anti-stall. No, MCAS does exactly what it's named for, to modify and augment the 'feel' of the flight stick for the pilot. Because Boeing uses a 'pilot in the loop' design approach, the physical feedback from the flight stick is critical to safe flying, and cannot be faked.

What MCAS does is make is to that you have to apply a proportional amount of force on the flight stick to pitch up a given amount (regulations define how far from linear this relationship can be). With the new engine placement, it would not require as much force as you would expect from earlier planes, which could lead to pilots approaching stall conditions unknowingly without that feedback. There are still anti-stall measures to prevent an actual stall (e.g. stick shakers), but the intuitive 'feel' of flying would be lost.

The initial MCAS design was reasonable, but test pilots felt that it wasn't strong enough, so it was changed. It is at this point, with no critical review being triggered, that the failure took place. The stronger system put pilots in a catastrophic situation in the event of a malfunction, and two independent flight crews failed to overcome the error.

In software this hack is explicit, so perhaps Boeing engineers can be forgiven for not seeing it when it straddles hardware and software.

"Boeing considered MCAS part of the flight control system, and elected to not describe it in the flight manual or in training materials."

It... "could not be overridden by pilot resistance against the control wheel as on previous versions of the 737."

"Following the Lion Air accident, Boeing issued an Operations Manual Bulletin (OMB)[13] which outlined the many indications and effects resulting from erroneous AOA data and provided instructions to turn off the motorized trim system for the remainder of the flight, and trim manually instead. Until Boeing supplemented the manuals[14] and training, pilots were unaware of the existence of MCAS due to its omission from the crew manual and no coverage in training.[12]"

It wasn't just "a software bug". It wasn't just culture cutting corners. Even after the first crash they continued to cover up that MCAS was the cause. After the second crash they still refused and it wasn't until airlines started grounding planes that they caved in.

There's a lot more than regulatory oversight could have done. We haven't reached the limits in the slightest.

Its that politics got in the way of doing the right thing, which is declare the airplane "new" and re-train the pilots (vs a plain modification). Boeing didn't want to do that as customers didn't want the retraining expense so they used lobbying and cut the corner.

Not unreasonable, doing stab trim cutout is a memory item for most operating manuals - pilots were already the circuit breaker for other stab trim issues.

Automation working - great. Maintenance failures? Provide error messages (which occured here). Maintenance issues not resolved and automation misbehevior? Stab trim cutout memory item.

Despite all the claims that the stab trim cutout did not work all real evidence is that it did. Other issues around pressure on flight surfaces not explored properly making recovery in overspeed and other conditions very hard.

Badly designed system? Definitely. Brittle when facing poor maintenance? Clearly! Not taking into account broad pilot population. Of course. Definitely should be fixed, and frankly automation probably will be increased to decrease assumptions around pilot behavior which can be variable.

This accident was the result not only of this bug but a chain of issues. That's why flying in the US is pretty safe, the chain from procurement to maintenance to pilot training is strong so compensates for poor elements.

If you follow SAA technical for example there is evidence overseas that bogus parts are making it into plane repairs, with predictably bad results. We are not seeing that in the US (yet), though if inspections get soft I'm sure it would show up here too. Those bogus repairs will mean that some automation will break and the plane may not behave properly in ways that could have been designed around with better assumptions.

My prediction? We are going to get iphone style authentication / serial number chips in key plane parts with electrical connections and the plane will eventually refuse to fly without the right parts - just like your coffee maker and iphone. Right now it is trust based.

That was the assumption a year ago. Investigation has turned up tons of evidence against your null hypothesis. Crucially, this behavior was observed in the simulator and reported up the line.

> ... and a lack of backup sensors to offset the risk.

Not when multiple red flags were raised internally, and the backup sensors were sold as a premium upgrade.

> There will always be limits to how effective regulatory oversight can be.

Especially when we allow corporations to do their own regulatory "oversight"

Huh? The MAX was the most unsafe major new plane in ... something like decades. You can't make a statement excluding all the bad and then trying to say it's good. The bad is exactly what you're getting at here.

And even apart from that, the 737 is an obsolete, decades-old design. The only reason they're still making new iterations of it is because of type ratings requirements; if you actually wanted to make a great plane, you'd never base it on the 737. It has ancient analog gauge displays (which are now simulated digitally), doesn't use electronic flight controls, is too low to the ground leading to increased potential of foreign object debris into the engines, and as a consequence of this the newer more efficient jet engines don't even fit underneath the wings properly and hence had to be shifted forward into an unstable position that necessitated MCAS.

There's no two ways about it, there's nothing good about the 737 MAX, even apart from all the crashes.

Aside from regulation, There are very good business reasons from both ends of the industry that exert pressure to iterate on an old design. (E.g Each additional airframe dramatically increases the complexity of an airline's maintenance organization.)