Hacker News Reader

Comment by hn_throwaway_99 | Hacker News Reader

That seems like a huge mistake to me. As it's been said many times, "Safety regulations are written in blood." At this point we probably know more about the flaws in the MAX than almost any other aircraft. And it's not like the plane was fundamentally unsound at a design level, but that bean counting, shortcuts and a failing culture made it unsound.

I mean, I haven't heard anyone of authority say the flaws with the Max aren't fixable. If the Max "never flies again", it will just be because it's rebranded, not because it's a fundamentally different aircraft.

View on HN

> And it's not like the plane was fundamentally unsound at a design level, but that bean counting

I'm not an airframe designer by any means but from the countless threads that I've read on this website about this subject (coming from people who seemed more knowledgable than me on the subject) it did seem like the plane was fundamentally unsound at a design level.

Same. My understanding is that adding larger engines, and moving them forward on the wing, make the the airframe unable to fly at level altitude without software automatically adjusting the pitch.

Not quite. The issue is that, due to the engine placement and its effect on center of gravity, the aircraft will tend past a certain angle of attack to start nosing into a stall, rather than away from one. MCAS was added to counteract this highly counterintuitive and dangerous tendency by automatically driving the horizontal stabilizer to nose the aircraft back toward level flight.

As I understand it, the 737 MAX was the first commercial airframe ever approved by the FAA with this sudden inflection point in behavior when approaching a stall. (There's a term for it, something like "positive rate characteristic", but I forget. Perhaps someone who knows it will mention it here.) Seeing how well that worked out, one hopes it'll also be the last such airframe approved.

They're pretty adamant that it's not an anti-stall feature - those normally have 'stick pushers' or shakers.

Considering that both crashes occurred because of MCAS acting as intended on the basis of invalid data from a failed AoA sensor with no backup, I feel like that would be a surprising lie for Boeing to have told.

edit: And, having checked the Wikipedia page for the system, I find myself surprised that that is in fact a lie Boeing has told.

They may as well go ahead and try to rebrand the damned thing, I guess. On top of everything else they've done, I can't see how it would make their problems any worse...

also edit: Via Wikipedia, 14 CFR 25.203: "No abnormal nose-up pitching may occur. The longitudinal [pitch] control force must be positive up to and throughout the stall." This is the characteristic the MAX lacks due to the engine placement. If you want to add an active system to correct for that, the AoA sensor is what you use to drive it, since that's what tells you the difference between the direction of airflow and the angle of the wing. That's how you know you're approaching a stall, and need to add a negative pitching moment. But if that sensor jams, which being a mechanical device it can do, and you don't have input from another sensor so you can see the disagreement, you risk spurious activation of the system when it isn't needed, potentially forcing the aircraft out of level flight.

I get that it's in Boeing's interest to claim MCAS isn't an anti-stall system. Why would they say anything else? To do so would implicitly admit not only that they built an aircraft that would fail dangerously in a common situation, but also that the FAA let them get away with selling it and selling it as type-identical with prior versions lacking the fail-dangerous characteristic. Neither admission would serve their interests.

But, equally, why should we take them at their word on this, or indeed anything? It's pretty clear that their corporate interests have ceased to align with ours as potential airline passengers. It's generous unto foolishness, in light of that, to give them the benefit of any doubt whatsoever.

https://www.law.cornell.edu/cfr/text/14/25.203

They were pretty desperate to maintain the 737 type certification, to reduce airline adoption cost. So the question is: are they right, or are they stretching the truth via motivated reasoning?

This is a remarkably generous framing of the question. Why exclude the possibility that they were simply lying? Oh, I'm sure the engineers didn't like it, and said so. I believe the news has reported to that effect, based on internal emails. But when did people with golden parachutes start deserving the benefit of the doubt, in this industry or any other?

> the aircraft will tend past a certain angle of attack to start nosing into a stall, rather than away from one.

Virtually all aircraft will do that, including the original 737. Different aircraft do this at different points; provided the pilot is trained for the aircraft, it's not a fundamental problem.

The problem for the MAX is they wanted pilots to be able to treat it like an airplane it wasn't.

https://www.law.cornell.edu/cfr/text/14/25.203 seems to say otherwise - specifically, that you shouldn't be able to stall a certifiable aircraft unless you maintain a positive (ie nose-up, pulling back) control force "up to and throughout the stall". If that were true of the 737 MAX without MCAS, then MCAS wouldn't need to exist. All you'd need to do to avoid a stall would be to stop pulling back on the yoke, and let the aircraft settle on its own. Stick shakers exist to warn the pilot that they need to stop pulling, and the 737 MAX has one.

But evidently the stick shaker isn't enough, because the 737 MAX also has MCAS, which operates to actively deflect the nose back down as the aircraft approaches stall. That shouldn't be necessary. That's the thing that other airframes, including prior marks of the 737, do not do. In those airframes, you don't need to push the nose down to get away from a stall. You only need to stop pulling the nose up. MCAS exists to try to replicate this behavior in the 737 MAX, but that MCAS needs to exist for that purpose is enough to demonstrate that the 737 MAX does not behave that way by default.

I agree that the falsely shared type certification, and the consequent lack of training on the MAX's type-unique and dangerous stall behavior without MCAS, is a problem. Where we disagree is that I don't consider acceptable a design that exhibits that behavior at all in the absence of an active control system that can fail or be turned off. Neither do the relevant regulations for certification - I linked them above; they make no mention of an exception for an airframe with something equivalent to MCAS - and neither, historically, has the FAA. Not, at least, until the 737 MAX was itself type-certified, and the way that process played out is itself highly suggestive of significant corruption, in the form of regulatory capture if nothing else.

My own understanding is that the whole problem is to avoid the costly pilot training on the MAX by making it behave like a regular 737. That's where the automatic pitch adjustment at high angles of attack comes from. Had Boeing decided that companies would have to train the pilots for a new type of aircraft (which the MAX actually is), none of this would have happened.

This is actually the problem. If they were willing to change the type certification, they would have been free to raise the airplane up and keep the engines in their proper position. The need to keep type certifications the same is the root cause of a whole series of bad decisions, including engine placement and the unwillingness to change pilot training & documentation.

> free to raise the airplane up

How do you suppose they might do that without completely redesigning the plane? I don't think type recertification is why they kept the landing gear the same length.

There certainly would be other costs associated with that, but the primary motivator for not redesigning their aircraft was maintaining type certification, not the cost of a clean redesign. If the Max8 could keep the same type certification, pilots could cross over without long and expensive training, and without losing their rating on their prior aircraft, making adoption a no brainer. If the Max8 doesn’t keep a type rating, there’s less of an incentive for current 737 customers to buy a Max8, since they’ll have to go through the same logistical hurdles that introducing a A321neo would have.

Plus Southwest basically won’t buy anything but 737s, so maintaining that type rating was critical to selling the new plane to one of their biggest customers.

It absolutely is. Boeing already made a stretched 737 with larger engines. It's called the 757 and they stopped making it because airlines wanted bigger 737s.

Lengthening the landing gear is a non-trivial design change. It might be more feasible to shorten the fuselage on a 757 than reengineer the gear on the MAX.

The point is not “raising the vehicle height would be cheap”; it obviously wouldn’t. The point is that one of the key requirements was maintaining the 737 type certification. If that requirement was thrown out, they would’ve made a better airplane that wouldn’t have sold anywhere near as well as the MAX8.

Since the 787 is somewhat a clean sheet redesign of the 767, Boeing wants to do the same with the 757 and is currently trying to get the traction with airlines to do that.

Boeing had initially proposed a clean sheet redesign of the 737, but the market for that aircraft is very sensitive to training and operation costs.

As of very recently they’re looking into putting new engines under a 757 and adding some carbon composite for lightness. They’re referring to it as the 757-Plus.

That’s basically what airbus did to create the A320neo series; add in larger engines (including the same one the MAX8 uses, actually), and make a few minor tweaks to improve weight or aerodynamic efficiency. Done correctly it’s a brilliant move; 15-20% fuel savings without the need to significantly change pilot or maintenance (sans engines) protocols. Sadly the MAX8 was not done correctly.

> making it behave like a regular 737

Not really. Without MCAS, the plane would not have been certifiable. (So, MCAS does make it more similar to the regular 737 in that it is certifiable, but that was not the only reason.)

I don't believe that is the case. The MCAS system was added because the handling of the plane was different to previous models at higher angles of attack. The system was meant to compensate to give the same handling 'feel' as older 737s to pass certification without requiring significant re-training of pilots.

I believe that is overstating things. From what I gather, it is during specific flight conditions, namely high angles of attack at high airspeeds, encountered during an extreme manoeuvre (definitely not straight and level flight), namely a wind-up turn (a turn at increasing bank angle and constant speed and constant power (note that this implies accelerating descent), rarely if ever encountered during a routine flight).

This is flown to test the stick force as a function of load factor. Now, it is a certification requirement that the stick force increases basically linearly with the load factor ("The stick force curve must have a stable slope" [3]), and that was not given - the stick slacked.

This is what MCAS was designed to address.

From what I gather, a 737 MAX without MCAS would not be certifiable, but safely flyable, possibly with some surprising, but manageable behaviour under very rare circumstances: namely, flying at a high angle of attack with high speed would require you to release some stick force instead of having to pull hard to keep the nose up.

Having said that, the whole saga has revealed so many problems at Boeing and the FAA that I am reluctant to fly the 737 MAX and 787 myself.

https://www.seattletimes.com/seattle-news/times-watchdog/the...

https://www.scribd.com/document/53095046/NASA-Information-Su...

[3] https://www.law.cornell.edu/cfr/text/14/25.175

That's not really an accurate depiction. All planes constantly change the control settings required during different flight conditions in order to maintain level flight, often with software. Different speeds, flaps, weather conditions all require different trims to those control settings. If your plane gets new flight characteristics through a design change, the configurations your training told you should work will probably not work anymore.

What Boeing did was hide the change in flight characteristics caused by the new engines using software, so pilots didn't need to retrain, and they borked the implementation.

> threads that I've read on this website

I strongly recommend not getting your 737-MAX facts from HN. Every time the topic comes up, the discussion continues to be riddled with inaccuracies, many of them strongly held beliefs.

It's absolutely not unsound at any level. It simply handles differently than pre-MAX 737s in certain scenarios, which would have required pilot re-certification if not for the flawed MCAS software.

From what I understand it would not get certified today if it were introduced as a new airplane completely unrelated to any others, for a variety of obscure reasons.

However if the original 737 in the 60s had the design of the MAX, its pilots would be taught how to fly it without any MCAS software and it would fly just fine.

You understand incorrectly. The 737 MAX would have no trouble being certified as a new type without MCAS. Boeing did not forget how to design planes.

Without MCAS wouldn't the plane be unbalanced due to engine placement issues and excess weight?

From my understanding, the MCAS system was built to offset these problematic default states that come with using an old body not compatible with the upgrades made. I also heard the weight of these new engines caused wings to develop stress cracks.

Not sure how it could be considered safe without a better designed MCAS system and addressing the other issues.

You seem to be conflating ideas. jaywalk said it best with:

> It simply handles differently than pre-MAX 737s in certain scenarios

It handles differently than previous 737s due to airframe changes (namely engine position). MCAS was meant to "correct" this for the purpose of skipping re-certification. The airframe isn't fundamentally flawed, the process of certifying it this round was flawed. Which caused Boeing engineers to implement a flawed MCAS system.

I believe this to be a myth. MCAS is not "just" so that it feels like the old 737. Without MCAS, it would not be certifiable.

See for example here:

https://aviation.stackexchange.com/questions/73132/did-boein...

That statement is incorrect. It would be perfectly certifiable with additional pilot training. The killer feature was the theory that MCAS would allow airlines to get away without additional training. Practice proved to be quite different, as is so often the case.

Do you have an authoritative reference for that, stating unambiguously that the plane without MCAS would fulfil all the regulatory requirements for manoeuvring stability in terms of stick force curve slope, for example during a wind-up turn?

(I agree, FWIW, that the plane would by flyable, easily in nearly all flight regimes, and carefully in some flight regimes, without MCAS. But that is not the issue at hand.)

My understanding is that it would not have been certifiable under part 25.175, requiring a control stick force curve with stable slope across a wide variety of flight regimes.

https://www.law.cornell.edu/cfr/text/14/25.175

The force curve precluded single-certification without MCAS, but I haven't seen any claim that it would not be certified at all. 'Stable' is the critical term, and is loosely defined.

In reality, the force curves always deviate from the ideal, save in fly-by-wire designs. There are two different issues at play:

The first is a force curve that deviates so much that it becomes unintuitive or unmanageable to fly. This would not be acceptable, but I have not seen someone claim the 737 MAX would be characterized this way.

The second is whether the force curves of the older 737s matched the MAX closely enough. These pilots are expecting a certain behavior, and under single certification, could be going back and forth between these models often. Even small differences in handling between these could be jarring and lead to bad stick inputs.

This is a much more demanding requirement because of the context; in the first case, a pilot is making one transition to a new aircraft that they expect will be different from what they flew before. In the second, they are switching between aircraft often, perhaps after long stretches of becoming accustomed to one model or the other. They must then constantly be aware of these differences and continually adjust for them, a situation ripe for error.

My understanding is that the 737Max flies kinda like a 757 without MCAS. It's not a big deal.

Insightful clarification.

It is hard to find reliable sources on this, I must say.

I base my conclusion for example on these excerpts from [1]:

> MCAS would trigger in narrow circumstances. It was designed “to address potentially unacceptable nose-up pitching moment at high angles of attack at high airspeeds,” Boeing told the FAA in a proprietary System Safety Assessment

(This doesn't specify whether it would be unacceptable for certification, or for certification under the same type certificate.)

> Engineers determined that on the MAX, the force the pilots feel in the control column as they execute this maneuver would not smoothly and continuously increase. Pilots who pull back forcefully on the column — sometimes called the stick — might suddenly feel a slackening of resistance. An FAA rule requires that the plane handle with smoothly changing stick forces.

(This seems to indicate that it would be unacceptable under the general FAA rule.)

[1] https://www.seattletimes.com/seattle-news/times-watchdog/the...

https://aviation.stackexchange.com/questions/73132/did-boein...

I've read there are various details of the airplane unrelated to aerodynamics that are considered fine in a legacy design but would need to be revised if the 737 MAX were to be certified from scratch.

Here is one example: https://www.reuters.com/article/us-boeing-737max/boeing-prop...

My understanding of that issue: The 737 is wired in such a way that was considered fine when it was designed. In 1998 an MC-11 crashed which resulted in revised design standards that would render the 737's wiring invalid, except the 737 was already a proven design by this point and consequently has been allowed to continue flying the way it is. The 737 MAX continues to use this wiring configuration, which was initially considered fine because the the 737 MAX "is a 737", a proven legacy design.

> Boeing did not forget how to design planes.

I certainly did not and would not suggest otherwise. It's possible I'm mistaken about the above, I'm certainly not an expert on FAA matters, but I earnestly don't think I'm wrong. If you still think I'm wrong, I'd appreciate a substantive correction.

Using a single AoA sensor to drive a safety-critical system -- a largely-undocumented one at that -- wasn't "unsound?"

If I have this wrong, btw, I'm more than open to correction. Downvoting without commenting doesn't say "You're wrong," it says, "You're right, but ptthhthhhth."

I was referring to the airframe itself. The plane is perfectly capable of flying without MCAS, it just doesn't handle the same as pre-MAX 737s.

It was unsound in terms of having single points of failure in the flight computer. When a cosmic ray bit flip can send you into the ground, you cannot carry passengers.

The safety analysis was turbo hosed, the documentation was shat, they hid the issue from operators and regulators alike, and went out of the way to not make simulators.

They removed previous generation's safeties (the oh shit yank back hard electric trim switch override), and removed a level of granularity in terms of capability to isolate the flight computer from the trim motors (which they have to do because they can't certify the plane to carry passengers otherwise), they have electrical control and power circuits to the trim motors too close together, and not sufficiently protected from a thrown turbine blade.

The aerodynamics (without MCAS functional) fail to pass airworthyness requirements for passenger transport that have been in place since time immemorial, and critical structural components (pickle forks) are showing alarming degrees of premature failure given their design lifetime.

Explain to me how a plane that doesn't at all implement graceful degradation to a fundamentally safe configuration is not "fundamentally flawed". Explain to me how plane's assembled from components that are failing well before their designed lifetime (and yes, I understand MTBF) is not a sign fundamental flaws. Even with all the fixes they're doing, the design shows an astonishing lack of good engineering sense. You don't keep around an awkward, unpredictable, unergonomic tool built by someone who demonstrated a willful disregard for doing Generally Accepted Engineering Practices, and who have repeatedly been found to do stupid things like leaving tools or metal shavings to foul or clog up filters, damage gaskets/seals etc.. You bin it, and make/get one that won't kill 200 people a failure instead. I don't give a damn how expensive a mistake it was.

There are lines you don't cross. Supporting bad business is one of them. Bring on the Depression. Maybe it's time we all figured out what good business looks like all the way around again.

And no, all that isn't belief or mere opinion. It's fact laid bare for all to see. You can fly on them and risk your loved ones if you like. I know the mentalities that drive those types of boondoggle and I'll have none of it. Show me a massive culture revamp in Boeing first, then I'll consider it again.

You're missing OP's point. MCAS was flawed, but the plane would have been fine if they hadn't added MCAS. It would just have required pilot retraining (which Boeing desperately wanted to avoid). I have never seen a reliable source for the claim that the handling characteristics without MCAS would fail to meet airworthiness requirements.

There is nothing wrong with using software to correct for instability; the B-2 Spirit is far less aerodynamically stable then the Max and it's only had one crash in its entire 23 year service history.

Boeing failed to provide sufficient redundancy for the MCAS system and proper training to the air crews.

It wouldn't surprise me, though, if in its entire service history, the B-2 has had fewer total flights than the 737 Max has...

Not to mention to most rigorously trained pilots and the face of the planet. Not to mention the tops minds designing the Aircraft and the software, rather than outsourcing it to code-by-the pound shops like Boeing did.

One way to look at it is that 5% of all B-2s ever built have crashed.

Military planes fly a little differently from passenger planes and the humans inside those planes expect different handling characteristics.

Freight carriers still fly MD-11 as they’re economical and its flaws are well understood, but passenger carriers don’t touch it or the TriStar with a 10ft pole, I think that’s the answer.

Not sure the 737 Max is big enough to be a freighter, though.

Alaska Airlines operates a number of 737 freighters because of how Alaska the state works logistics wise.

People in Alaska will do things like come down to Anchorage and buy all their supplies for several months from Fred Meyers and Costco and box it all up on a freight pallet and have Alaska Air ship it back to the remote area these people live in.

> probably know more about the flaws in the MAX

The thing is, we do know a lot about those flaws and the only way to really fix those flaws is with a clean-sheet redesign.

The MAX would have flown again, for sure, pre-COVID. However, designs without known fundamental design flaws can handle worldwide airline lift needs for the foreseeable future.. and it's legitimate to wonder what that means for the future of the MAX.

> The thing is, we do know a lot about those flaws and the only way to really fix those flaws is with a clean-sheet redesign.

That's just not true. People seem to be conflating the fact that the design required software-controlled stability (e.g. MCAS) as a "fundamental" design issue. That's just not the case. The problems were:

1. MCAS was not sufficiently redundant.

2. Boeing tried to get away with the changes to the MAX without requiring recertification or pilot retraining, which was just wrong.

Both #1 and #2 have straightforward fixes.

Yes, I'm kinda surprised they didn't use the COVID lockdown period to do proper pilot training.

Most pilots and planes were basically sitting idle anyway. It's good for them to remain somewhat active. And fuel was given away for pretty much free because the overproduction was filling up expensive storage space.

This would have been the ideal moment to teach 737 pilots to properly handle the Max aircraft without needing MCAS.

> This would have been the ideal moment to teach 737 pilots to properly handle the Max aircraft without needing MCAS.

Well, its not legal to have the 737 MAX without MCAS, so its a moot point.

MCAS exists to compensate for undesired control forces as high (near-stall) angles of attack, its not legal to have those performance characteristics in an aircraft.

If this was Airbus, this would have been done in software since the A320 series is fly by wire.

#1 requires fitting another AOA sensor vane. This is not being done. It would void the existing type certification, at which point the reason to avoid a clean-sheet redesign is gone. If they could have designed a new aircraft around the more efficient engines at the same size and have airlines buy it they would have. But without a 737 type certificate Southwest (their largest single customer for 737s, Southwest only flys 737s) won't buy and many others will be more reluctant to buy.

#2 is being changed.

> #1 requires fitting another AOA sensor vane

This is baloney. There are already 2 AOA sensors on the plane, but MCAS originally only read from one of them: https://arstechnica.com/information-technology/2019/03/boein...

There need to be at least 3. With two a disagreement cannot be resolved by majority, so the new MCAS will have to disable itself. Pilots will need to be trained to handle this failure mode, and the indicators will need to be added to all the planes (and will need to work, that was an additional issue).

This is a fundamental design flaw for a system which can have catastrophic consequences. This should have been classified as a DO-178B level A system (capable of crashing the plane) but was misclassified by Boeing. DO-178B level A systems require triple redundancy.

I think this might have some truth to it.

For example, the DC-10 was also a flawed airplane with a terrible safety record in the 70's which was grounded by the FAA as a result. But the flaws were fixed and the plane is still in operation today, now with a safety record comparable to other similar planes.

Cargo bay doors was the problem with the DC-10. The doors were re-engineered so they were fail safe. They did have other problems but fixing the door latches was it. This is in a different league of design fault to the 737 Max and MCAS.

Furthermore this was in a different era before the internet. People only had the mainstream news to go on.

https://www.bbc.co.uk/news/uk-england-birmingham-26259236#:~....

How is it in a different league? We know why the planes crashed, and we know what to do to fix it. Add some AOA redundancies, and get a new type certification that requires pilot retraining.

Safety is not a complicated goal to achieve. You identify hazards and you rectify them. The hard part is identifying them, which in this case has already tragically happened.

Not really. The fix for the cargo doors was not affecting the aerodynamics, centre of gravity and how the plane handled. The pilots didn't need updated type certification for the fixed cargo doors.

Your easy fixes for the dreaded 737 max sound like those of an armchair expert.

It is my understanding that the inherent handling characteristics of the 737 Max would have been acceptable under a new type certification, without MCAS. Is this incorrect?

Reply on news.ycombinator.com