How the Boeing 737 Max Disaster Looks to a Software Developer (2019)
spectrum.ieee.org
spectrum.ieee.org
https://news.ycombinator.com/item?id=19694207
(528 points/299 comments)
> I believe the relative ease—not to mention the lack of tangible cost—of software updates has created a cultural laziness within the software engineering community. Moreover, because more and more of the hardware that we create is monitored and controlled by software, that cultural laziness is now creeping into hardware engineering—like building airliners. Less thought is now given to getting a design correct and simple up front because it’s so easy to fix what you didn’t get right later.
Personally, I have noticed this laziness creeping into areas that are not controlled by software at all after they are finished, like building or road construction.
1. Jet engines, like car engines, are not described by the "Carnot cycle", and their efficiency is not governed by it. The Carnot cycle describes closed-system equipment like refrigerators and Nuke plants. Jet engines, like (our now obsolete) cars, start with new working fluid -- air -- at the intake, and discard it at the end -- exhaust. Their theoretical limit of efficiency is technically 100%, not the 30-40% typical of Carnot equipment. In practice, they don't get close, but those huge ship engines do achieve up to 55%: they all take in air much, much cooler than their exhaust.
2. The change to the thrust vector is not a consequence of moving the engines forward. It is a simple result of the bigger engine diameter making the center farther below the wing. Moving the engines forward and up reduced the size of the change to the thrust vector -- just not enough so to match the old one. But the move had other effects, besides...
3. The added aerodynamic lift of the engine nacelles has nothing to do with more power being produced by the bigger engines. It is purely a product of the angle relative to the direction of air moving past. Bigger barrels have more area, and more lift, and moving them forward gave them more lever arm to apply their lift to rotate the plane instead of just holding it up, as wing lift does.
4. The change to the thrust vector is what makes punching the throttle also apply a force to rotate the airframe to a higher pitch angle. So there are two independent forces -- off-center lift, and off-center thrust -- both causing the same effect: pitching the plane up more than the pilot asked for. How much you get of each is a very complicated product of all the details of how the plane is flying.
5. On all 737s of any vintage, the controls really are still directly, physically connected, by steel cables, to the control surfaces -- the hinged bits at the back edges of wings and wing-shaped things. But there are hydraulics that also yank on the cables, and other stuff yanks on the control column, to doctor the pilot's experience.
>Most of those market and technical forces are on the side of economics, not safety.
People seem to think about airline safety a lot, like, an irrational amount given the risk. I would guess that over the decades consumer pressure was a huge driver of safety improvements, and the increasing automation seems to have been a big safety benefit on balance.
The risk that 300 Peoples at once can die? I think that's very rational.
https://edition.cnn.com/2020/06/25/business/pakistan-fake-pi...
and the crash that led to the findings:
Whats there to think about it? Don't drink it (or not too much), that's where YOU are responsible for YOUR life and not the life of others. The Airline and Pilots are responsible for your safe travel.
>road conditions for motorists and cyclists
In Germany 445 people died in bicycle accidents in 2018, that's 1.5 Aircraft's. And please just use a helmet, but you are right sure. But neglect Air-safety to make Roads safer sounds stupid...why not do both.
43% don't wear helmets and 37% are against mandatory helmets on bicycles, again that's YOUR responsibility:
https://www.thelocal.de/20161207/should-germans-be-made-to-w...
>we're probably over investing in airline safety.
No we hold Airline's responsible for it, if you don't do that this will happen over time:
https://edition.cnn.com/2020/06/25/business/pakistan-fake-pi...
>50s has a heart attack
True because it's not something you or i can change, maybe he/she had bad habits (drinking, drinking sugar etc) maybe genetic, maybe could not afford a insurance (and this is something we should and could change)
There are social costs to obesity and diabetes. They should be taxed like alcohol and tobacco and selling sugary drinks to children should be curtailed. We should have warning labels and government funded commercial campaigns highlighting the issue. We should subsidize healthier foods like vegetables and promote a healthy and active lifestyle. We should make nutritional education a core part of education.
> But neglect Air-safety to make Roads safer sounds stupid...why not do both.
We presently do both, but we underfund road safety and overfund airline safety. It's a matter of economics. If we're spending $10m per life saved in airlines and $300k per life saved on the road then we could save more lives by adjusting the expenditures.
> No we hold Airline's responsible for it
And I'm happy that we do, but we can still overfund health and safety in one part of the economy at the expense of the other.
Absolute no problem with that, but has nothing to-do with airline security.
>but we underfund road safety and overfund airline safety
I dont know where you life, but here 'WHE' pay nothing for Airline safety, but every passenger does, and flying is still too cheap.
>but we can still overfund health and safety in one part of the economy at the expense of the other.
I really don't know what a country that is, but here (Switzerland) every passenger pays a tax for the Airport which is responsible for the Air-control and the Security, and the Airport just lets Airlines land when they meet international Security standards, its not a public spend but a private one (from the passenger). And i think it's the exact same in your country.
Countries with biking cultures don't use helmets, because it's safe. Safer than countries with helmets. They just don't let cars ride fast near them.
I ride downhill (not on the street) and no one ever told my that riding without a helmet is safe.
Feel nonetheless relatively safe, because I never fell on my head in the few (spectacular) accidents I had, never broke any bones, always (actively) managed to land hard, or didn't even fall at all.
Imagine accelerating hard into an underpass within the flow of traffic from about 45kph to 60kph to have enough momentum for an easy climb up. And suddenly your handlebar including stern almost hits you in the face because the stern broke.
Doing some crazy moves to keep balance while still holding the handlebar in my hands, braking, not hitting any car, or the curb. Standing, upright...
In winter, on a frozen street, light curved downslope, losing control, gliding outwards, kicking against some pole to push me back, at about 20 to 25kph, back on course. Pole OK, leg too.
Entering a roundabout at about 60kph, hitting the rubberized rear bumper of an unexpectedly braking car with my frontwheel ever so slightly, flying about a dozen to 20 meters, actively summersaulting into a position with downspread arms to absorb some energy before final impact. Hitting hard, holding head up/forward, tingling hands and feet, but not hurt. Clothing unharmed also. (Bike was trashed unfortunately)
Tell me WHY I should wear a helmet?
Do you want us all to look like the https://en.wikipedia.org/wiki/Michelin_Man for safety reasons?
As a society the doctors can focus on diabetes, the aerospace engineers can focus on planes, and the city planners can focus on traffic safety, simultaneously.
The reason people are focused on airline safety (to the extent they are), is because there was a huge scandal. It's entirely rational to investigate.
Unfortunately, when budgets are finite, we cannot prioritize everything. OP's argument was that we spend too much money responding to visible, spectacular disasters, and too little on ongoing small harms which add up. There is some good evidence for this - for example Healy et al "Myopic voters and natural disaster policy", which shows that politicians overspend greatly on disaster response and underspend greatly on disaster preparedness.
Another example would be the response to the 2000 Hatfield rail crash, which killed four people. The expensive safety systems then fit on trains cost so much, and added so much to the price of a ticket, that they probably killed more people than they saved, because people moved to on the road - which is a much more dangerous mode of transport.
>we spend too much money responding to visible
I that case the Aircraft producer has to invests that money, NOT the public.
I'm not saying you are wrong, not OP, not you. But the argument is just plane wrong.
Again, nearly every commercial plane-crash goes with 100% loss of life, in a vehicle where you can not break or stop, if something important goes wrong you will crash and loose 300 life's.
But i think we all know that a plane crash or a train accident with 3 death's is much more Frontpage'able than toxic amount's of sugar in drinks, or pesticides, but that's a People and Press problem and not a technical one.
If the aircraft manufacturers, or government, or consumers spend money, it is, ultimately the same money, as a matter for the effects of society-wide investment.
I should not need to trace the path from one spend to the next for this to be clear. We choose, as a society, to spend a very great deal on making air travel much, much safer than car travel, and car travel less unsafe than it once was.
Meanwhile, people are dropping by the tens and hundreds of thousands from sugar poisoning that we permit because the sugar producers have good lobbyists and a truly massive and extremely effective propagada operation convincing people sugar poisoning is what they actually want because it will make them feel young and sporty, not fat and sick as we know to be true.
There used to be an equally effective operation for tobacco. We didn't get tobacco deaths under control until we kneecapped the propaganda.
We spend far, far more than on airline safety and auto safety for medical care for the people made sick by sugar poisoning.
Emm NO, best case it flows back to the society who pay for the product.
Public spending and money from private company's is definitely not the same (with the exception that apple forces you in the future to buy a iPhone).
Money is a mechanism to track and manage resource allocation in a society. Collectively, we make choices as a society, and the money is manipulated to effect those choices. We make poor choices when we confuse choices about money with choices about society.
Yeah you turn around my words, if Boeing invest in the security of the airplane at the end of the day they have less money.
>Collectively, we make choices as a society
Again Boeing is NOT a society.
> capable of hashing
Using a modern fancy hash? Maybe not, I'm not sure. But you can bet your ass they can at least work with hamming codes. They're probably doing a lot more validation than you seem to believe possible.
Those systems probably have ECC memory, but who knows how many bits? And none of that helps you if the software you're loading into the system is corrupted in the first place.
Any procedure that relies on a human to verify the data integrity is broken. Based on what we know today, the FAA is completely incompetent and Boeing does the absolute minimum required to get a plane off the ground. Why should I expect them to do literally anything? They need a top to bottom audit.
> Those systems probably have ECC memory, but who knows how many bits? And none of that helps you if the software you're loading into the system is corrupted in the first place
My above comment had nothing to do with ECC memory. I am talking about using error correction codes with the data read off the disk, not merely to protect against corruption in RAM. That would catch the scenario where data is corrupted on the floppy before it ever touched the plane. If you have a source that suggests nothing of the sort is being done, then present it. Otherwise all you have is dumb speculation. And even if where the case that no verification is being done, that would be more a failure of the software than the floppy hardware. There's really nothing concerning about the use of floppies at all; if they were using modern flash instead I'd still expect them to be automatically verifying the integrity of all updates. Trusting flash is hardly less stupid than trusting a floppy.
There is one big difference between using floppies and flash though; the floppy system has proven itself in the field and was created in past years hopefully before the FCC's recent dysfunction, while a flash system would not be proven in the field and would be created under an FCC known to be dysfunctional. This alone should be a great reason to not fix shit that isn't broken.
FAA has always been dysfunctional. It's just that nowadays with the internet, Boeing and the FAA can no longer control the narrative to the same degree. Just look how how they handled the crashes in the 90s [1]. The FAA and Boeing basically dismissed the crashes entirely with shoulder shrugs. Their mouth pieces repeated the refrain 'safest form of travel' over an over. They were asleep at the wheel then, just like now.
And even if that weren't the case, you're ignoring all of my other points, particularly the one about the floppy system being proven in the field for years, and your failure to provide examples of accidents attributable to the use of floppies.
Come up with some sources specific to your concern about floppies if you can, or this conversation has run its course.
> Their mouth pieces repeated the refrain 'safest form of travel' over an over
Unless they're covering up thousands of fatalities (they aren't), the statistics are pretty clear.
I don't think the FAA could satisfactorily prove to me that corrupted data has never made it onto a plane and that plane wasn't thereafter flown with passengers. Software has been getting a free pass, I doubt they have ever competently audited any flight control software.
>I’ll say it again: In the 737 Max, the engine nacelles themselves can, at high angles of attack, work as a wing and produce lift. And the lift they produce is well ahead of the wing’s center of lift, meaning the nacelles will cause the 737 Max at a high angle of attack to go to a higher angle of attack. This is aerodynamic malpractice of the worst kind.
>Apparently the 737 Max pitched up a bit too much for comfort on power application as well as at already-high angles of attack. It violated that most ancient of aviation canons and probably violated the certification criteria of the U.S. Federal Aviation Administration.
Pure bullshit. Many low wing passenger aircraft have this tendency somewhere in their flight envelope. You can tone it down with some aerodynamic trickery but it's just a fundamental trade-off you get when the engines are below and forward of the wing, the load is above the wing and you pin the throttle. The reason we got ht MAX debacle was because the new 737 had this tendency to a degree and in a portion of the flight envelope different than the old 737 which meant it couldn't ride on the old 737's cert without a bandage over that. The 737 MAX8 handles perfectly reasonably for an airborne bus. What it does not do is handle perfectly reasonably for a 737-800 hence the reason they overlaid half baked software taking inputs from less than adequate hardware systems (well they were adequate for the less critical systems they were designed to feed into).
>Let’s review what the MCAS does: It pushes the nose of the plane down when the system thinks the plane might exceed its angle-of-attack limits; it does so to avoid an aerodynamic stall.
No. It (when it's no malfunctioning and trying to put you in a dive) pushes the nose down when you're getting into the portions of the flight envelope where the MAX flies differently than the old 737 in order to fudge the same handling as the old 737 thereby skating by on the old cert.
Big disasters require many small things to go just right. If the software was more robust this wouldn't have happened. If the hardware was more robust this wouldn't have happened. If the UX had been compatible with the pilots existing knowledge this wouldn't have happened. If the airlines were willing to pony up for type certs this wouldn't have happened. If the FAA had been hard asses this wouldn't have happened. To play it off as "Boeing tried to fix a bad plane with software and failed, whoopies" is exactly the kind of naive surface level postmortem that results in nothing being learned and these kinds of failures happening again. I know that opinions that deviate from "software engineers are angels that never do anything wrong and corporate is the devil also those hardware guys gave the software guys a crap situation to deal with" is not going to be appreciated on HN but the fact of the matter is that any one of the five-ish parties here (FAA, customers, and engineering, software and management within Boeing) could have broken this chain resulting in a different outcome and to prevent future events like this we need to understand the decisions that happened at the margin that prevented the chain of events from being broken.
>This abnormal nose-up pitching is not allowable under 14CFR §25.203(a) "Stall characteristics". Several aerodynamic solutions were introduced such as revising the leading edge stall strip and modifying the leading edge vortilons but they were insufficient to pass regulation. MCAS was therefore introduced to give an automatic nose down stabilizer input during elevated AoA when flaps are up.
The 737 Max was not certifiable without MCAS at all.
>it must be possible to produce and to correct roll and yaw by unreversed use of the aileron and rudder controls, up to the time the airplane is stalled. No abnormal nose-up pitching may occur. The longitudinal control force must be positive up to and throughout the stall. In addition, it must be possible to promptly prevent stalling and to recover from a stall by normal use of the controls.
Pretty much all commercial airliners are gonna pitch up if you're nose high and have the throttle pinned. Arguably the degree to which the MAX does this is novel. I think it likely handles like shit in that part of the flight envelope but does it really handle like such shit that it's not safe? I don't think so. Remember, this is basically a company truck. You just have to know it's an issue and be trained to operate it properly. Most people would be appalled at the braking characteristics of unladen semi-trucks but it's a non-issue because everyone who has to drive one knows that in those specific circumstances it will handle like crap. At the end of the day it is a matter of degree and opinion. Yes, you can win some quick virtue points by taking a stand in the name of safety and saying that nothing more than the most minor pitch up is acceptable but I think that had this aircraft gone for a FAA certification as a new type it would have passed just fine.
I don't know enough about airplanes to say if the MAX could have certified as it's own type. I'd like to hope it could because if not then that would show a very sorry state of affairs indeed.
But the big issue with the MAX is not that it handles differently, it is that Boeing lied to everyone about that fact. Then they made another semi-unforgivable error by masking the handling with software, ok, but didn't even take the most basic steps available to ensure some redundancy in that software.
It is just so very very bad engineering and mindset that it's hard to describe.
Would I fly on a MAX if and when they get clearance again? Maybe after it's been flying for a year or so, and depending on what some trusted people and institutions say about it.
Which is exactly what I'm saying and the opposite of what the author and DTAL are saying.
>It is just so very very bad engineering and mindset that it's hard to describe.
I don't think it's even a mindset. It's that sort of "nobody is responsible for a large enough part of the system to be able to stop things and force things to be done right" situation that a lot of big-cos get into that results in them crapping out half baked products.
>Would I fly on a MAX if and when they get clearance again? Maybe after it's been flying for a year or so, and depending on what some trusted people and institutions say about it.
For me the decision would hinge on what training the pilots get.
I agree that plays a part.
But the people in charge of the flight computer software should know better than to have no redundancy.
And the executives definately are able to stop things and force them to be done right, and instill in their employees a mentality of safety-first. But their bonuses might have suffered, so...
None of those things are small. They are all glaring errors willingly overlooked only because of the last point you mentioned which is money.
This is not a case of unfortunate accidents that can advance peoples understanding of avionics. This is a case of serious (in my opinion criminal) negligence motivated by a desire for more money this quarter and the next.
Here a list (and it is probably not exhaustive):
https://www.nbcnews.com/sciencemain/10-causes-titanic-traged...
The logical consequence is that with overwhelming probability, for this big disaster that happened with the 737 Max, a whole number of disasters were narrowly avoided because one of these many requirements for the fatal failure was missing. And theses near misses were not reported, which comes back to a deficient safety culture.
... but the aerodynamics were changed in the process and they fixed it with software, which was bad.
Everyone did their job as it exists on paper but... https://youtu.be/452XjnaHr1A?t=20
https://en.wikipedia.org/wiki/General_Dynamics_F-16_Fighting...
What do you mean by that? That they're crashing for unknown reasons? Because that's generally not true. A lot of effort is put into figuring out the causes of crashes. If you're insinuating that the software is generally to blame, I'd like to see your sources for such a claim.
The first F-35 to crash was due to a faulty fuel tube. Was that "for no good reason" or does that count as a "good reason"?
I didn't find any specific statistics, but I remember reading it in a book about the Swedish airforce some years ago that fighters just crash alot. They seem to just be way more prone to crashing due to their combat agility need.
E.g.: https://economictimes.indiatimes.com/news/defence/13-fighter...
Supermaneuverability is the primary reason fighter jets are designed to use such systems, but these systems also see use in other sorts of aircraft for other reasons. The F-117 was stabilized by a computer controlled fly-by-wire system because its aerodynamics were fucked up due to its unusual shape (which was motivated by stealth considerations.) A few F-117s crashed but as far as I know none of those crashes were attributed to software fucking up.
Similarly, the B-2 is inherently unstable (being a flying wing without vertical stabilizer.) Only one B-2 has ever crashed. That one crashed because condensation in air data sensors caused an inaccurate airspeed to be computed. However it's not clear to me that human pilots would have faired any better given the inaccurate data. Even if that crash is blamed on software, the B-2 still has a great track record and the all the public information about the in-development B-21 suggests it too will be a software-stabilized flying wing.
This all said, the 737 MAX isn't even a relaxed-stability airplane.
>There are instructions on how to detect when the system malfunctions and how to disable the system, immediately. Disabling the system means pulling the autopilot circuit breaker; instructions on how to do that are strewn throughout the documentation, repeatedly. Every pilot who flies my plane becomes intimately aware that it is not the same as any other 172. This is a big difference between what pilots who want to fly my plane are told and what pilots stepping into a 737 Max are (or were) told.
Which really implies that no such procedure existed for the Max, and that's just not true. There may have been problems with the procedure, as far as I know it's not fully known yet why that procedure didn't prevent the accidents, possibly inadequate pilot training.
https://www.flightglobal.com/safety/trim-cut-out-puzzle-emer...
The only way in the 737 Max to disable MCAS, is to disable electric trim altogether. That means only manual trim is available. When MCAS has trimmed all the way to one of the extremes (as happened in the Ethiopean flight), it requires many revolutions of the trim wheel and superhuman strength to return it to a more appropriate setting (see e.g. https://youtu.be/aoNOVlxJmow?t=750).
Previous generations of the 737 had two buttons related to the electric trim: one disabled the automatic trim system, the other one disabled electric trim altogether. The 737 Max still has two buttons, but they both have the same effect: disable the electric trim altogether. The old system could easily have prevented the crash by disabling MCAS but leaving the electrically assisted trim enabled.
Boeing's procedure to make manual trim adjustments possible is to put the airplane in a dive, because that lowers the aerodynamic forces on the trim surface. When you're only a few hundred feet above the ground, that's not really an option. The pilots re-enabled the electric trim in the hope they could use it in their fight against MCAS. It's the only thing they could think of in the stress of the moment, faced with near-certain death and an airplane actively trying to crash.
In hindsight, after reading accident reports and thinking about it in the comfort of chair that's not crashing, there were things they could have done. Lowering the throttle would have lessened the forces on the trim surface, activating the flaps once the speed was low enough would have disabled MCAS. I can't blame the pilots for not coming up with that in the heat of the moment.