Hacker News Reader

Comment by yason | Hacker News Reader

The only credible way from here is to:

- remove the hack that is MCAS for the purpose of being able to piggyback on the old 737 type certificate;

- start the process of type-certifying 737-MAX as the individual design that it is without MCAS instead of trying to make it behave like the old 737 just to keep things on the cheap side;

- and offer free type certification for existing 737 pilots to obtain their certification for the un-augmented 737-MAX.

Even if they fixed MCAS bugs and added a couple of redundant angle of attack sensors the public won't trust the hack. And even if the public doesn't know to care, airlines will.

View on HN

Not quite. I don't think you all realize how stupendously expensive certifying a new type is. Boeing and the airlines wouldn't be prepared to absorb the extra costs just to have a slightly more efficient 737 at the other end of it.

- MCAS needs to die. I doubt I could have written a subsystem that tries harder to kill you if I tried. Everything about that hack is grossly negligent and possibly criminal.

- Both AoA sensors need to go to both computers.

- All planes get AoA indicators.

- All planes get pitch trim indicators.

- Any kind of MCAS2 should just be an alarm rather than moving control surfaces on its own. If the Max8 diverges too quickly for a human to handle, then Boeing is (and should be) well and truly fucked.

- Regulatory agencies need to have a streamlined 'subtype' certification that recognizes when 99% of the plane is the same and only review the differences. All this MCAS bullshit was to sneak in under a too-strict type certification system in the first place.

It needs three AoA sensors, like Airbus planes have. Two isn't enough for such a safety-critical system. When one malfunctions, you still need to know what the correct value is.

Three AoA sensors is still not enough to generate a confident consensus to allow an autopilot system capable of crashing the plane to function

On Lufthansa 1829, two of the three AOA sensors on an A321 erroneously agreed, causing a system similar to MCAS to kick in[1]

The sensors can fail due to being frozen, or also be damaged by birds traveling in flocks

[1] Third bullet point under the A321 heading: https://en.wikipedia.org/wiki/List_of_accidents_and_incident...

The thing is 1829 didn't crash, the pilots got an alert, figured out the problem, took manual control, and flew the plane. Defense in layers.

It would be ideal to use different technologies for the AoA sensors to help minimize common-mode failures. Integration and crosschecking against other systems (IMU, radar altimiter, DGPS, an open-loop model of the plane based on engine settings and control surface positions, etc) could give the pilots and flight envelope protection systems a better understanding of their situation. Also, the signature of a failed/frozen vane-type AoA sensor is pretty obvious and I'm surprised the software doesn't take that into account.

Good writeup on LH-1829: http://avherald.com/h?article=47d74074

It depends on what the flight characteristics of the Max8 really are - something I've not seen a good writeup on. If the plane really can get away from pilots, then you're likely right (i.e. it really needs a proper flight envelope protection system - and the Max8 is dead). If it's just that the plane flies differently from other 737's, then 2 + subtype training is probably sufficient.

I don't have numbers but I do realize it's very, very expensive. That's exactly why Boeing has tried to avoid a new type certification for decades, that's why they added MCAS to make MAX behave like the old 737, and I do think it's about the damn time they bite the bullet on that one. All this hassle will end up costing Boeing a lot more than a new type-certificate which would allow them much more runway in the future.

> start the process of type-certifying 737-MAX as the individual design that it is without MCAS

This might not be possible. The 737 is uncertifiable today without grandfathering of some rules

Those exceptions might not apply if you're doing it from zero

I don't think they can remove MCAS.

It might just be a feel thing, but the "constant backpressure when approaching stall" feel is required by the FAA certification for all aircraft.

An alternative solution:

- Split the MAX off from the 737 type certificate.

- Make MCAS super easy to disable while leaving electric trim enabled

- Train Pilots to recognise MCAS failures and turn it off

- Training all 737-MAX pilots to fly with MCAS disabled in simulators.

- Require both MCAS failure and flying with the degraded feel in pilots yearly simulator training.

> start the process of type-certifying 737-MAX as the individual design that it is without MCAS

Do you know that it would be impossible to fly without MCAS (or something very similar)?

They (B engineers) made MCAS not only for max to look like NG, but for compensate for very serious additional momentum due to engines moving forward

There would be big piece of software to watch for pitch and stall and react accordingly, no matter how you call it

"Pilots who flew Boeing 737 MAX planes registered complaints about the aircraft suddenly pitching downwards last year. ... eerily echoing reports from American pilots who complained of problems with the plane late last year."

Wait, Boeing were actually trying to do something _different_ than this?

They might just scrap the whole project.

Theoretically they can restart the 737-NG production line, the last one rolled off the production line just 6 months ago. I wouldn't be surprised if it was possible to bring production back up to volume within 18 months.

NG production is ongoing for the military Poseidon and Wedgetail programs so the supplier base is still active.

Reply on news.ycombinator.com