Comment by gomijacogeo | Hacker News Reader

Comment by gomijacogeo | Hacker News Reader

Parent Full thread

Not quite. I don't think you all realize how stupendously expensive certifying a new type is. Boeing and the airlines wouldn't be prepared to absorb the extra costs just to have a slightly more efficient 737 at the other end of it.

- MCAS needs to die. I doubt I could have written a subsystem that tries harder to kill you if I tried. Everything about that hack is grossly negligent and possibly criminal.

- Both AoA sensors need to go to both computers.

- All planes get AoA indicators.

- All planes get pitch trim indicators.

- Any kind of MCAS2 should just be an alarm rather than moving control surfaces on its own. If the Max8 diverges too quickly for a human to handle, then Boeing is (and should be) well and truly fucked.

- Regulatory agencies need to have a streamlined 'subtype' certification that recognizes when 99% of the plane is the same and only review the differences. All this MCAS bullshit was to sneak in under a too-strict type certification system in the first place.

It needs three AoA sensors, like Airbus planes have. Two isn't enough for such a safety-critical system. When one malfunctions, you still need to know what the correct value is.

Three AoA sensors is still not enough to generate a confident consensus to allow an autopilot system capable of crashing the plane to function

On Lufthansa 1829, two of the three AOA sensors on an A321 erroneously agreed, causing a system similar to MCAS to kick in[1]

The sensors can fail due to being frozen, or also be damaged by birds traveling in flocks

[1] Third bullet point under the A321 heading: https://en.wikipedia.org/wiki/List_of_accidents_and_incident...

The thing is 1829 didn't crash, the pilots got an alert, figured out the problem, took manual control, and flew the plane. Defense in layers.

It would be ideal to use different technologies for the AoA sensors to help minimize common-mode failures. Integration and crosschecking against other systems (IMU, radar altimiter, DGPS, an open-loop model of the plane based on engine settings and control surface positions, etc) could give the pilots and flight envelope protection systems a better understanding of their situation. Also, the signature of a failed/frozen vane-type AoA sensor is pretty obvious and I'm surprised the software doesn't take that into account.

Good writeup on LH-1829: http://avherald.com/h?article=47d74074

It depends on what the flight characteristics of the Max8 really are - something I've not seen a good writeup on. If the plane really can get away from pilots, then you're likely right (i.e. it really needs a proper flight envelope protection system - and the Max8 is dead). If it's just that the plane flies differently from other 737's, then 2 + subtype training is probably sufficient.

Not quite. I don't think you all realize how stupendously expensive certifying a new type is. Boeing and the airlines wouldn't be prepared to absorb the extra costs just to have a slightly more efficient 737 at the other end of it.

I don't have numbers but I do realize it's very, very expensive. That's exactly why Boeing has tried to avoid a new type certification for decades, that's why they added MCAS to make MAX behave like the old 737, and I do think it's about the damn time they bite the bullet on that one. All this hassle will end up costing Boeing a lot more than a new type-certificate which would allow them much more runway in the future.

Reply on news.ycombinator.com