Comment by cletus | Hacker News Reader

Comment by cletus | Hacker News Reader

So a lot is known at this point:

1. The A320neo caught Boeing completely off-guard;

2. The threat of the likes of American Airlines (already a mixed Airbus/Boeing customer and the largest airline in the world) placing a large A320neo order for regional aircraft operations scared the bejesus out of Boeing management;

3. For airlines like Southwest that are pure 737, the prospect of adding a plane that didn't share a common type rating with their existing fleet would complicate their lives and make them vulnerable to a sales pitch from Airbus; and

4. The development cycle for a completely new body was too long for many customers as it would arrive several years after the A320neo.

I don't think any of this is in dispute so the constraints for Boeing were to design a more fuel-efficient plane that shared a common type rating with the 737. To get there:

- They added newer, more fuel efficient engines. These changed the flight characteristics so they had to be moved;

- These engines moving made the plane more vulnerable to a stall situation. To counter this, they added MCAS, which would point the nose down when the AoA sensor told it the nose was too high;

- Standard configuration had 2 AoA sensors but MCAS only ever read from one;

- There was a safer configuration as an optional extra purchase;

- Telling airlines and pilots about this and providing overrides risked the common type rating.

I don't believe any of this is in dispute. It is widely believed, but not yet proven, that the primary cause of both fatal crashes was a runaway MCAS that drove the planes into the ground. It's also believed that with proper training a pilot may have been able to counter this (as happened the day before the Lion Air crash with a pilot in the jump seat).

Now what I find interesting is the response people have to all this. Some claim this is a fundamental design flaw that puts a shadow over the plane. Others believe it will be corrected and everything will be fine.

I'm firmly in the first camp: the plane CLEARLY flies differently to a 737. An automatic system, with no triple redundancy, was required to correct the flight characteristics of the plane.

I'm no expert but it seems to me the plane is fundamentally flawed at this point.

    >  the plane CLEARLY flies differently to a 737[...]

There's no such thing as "a 737". A 737-600 is 31 meters long[1], and a 737-900ER is 42 meters. Both share the same type rating with the MAX[2], and have the same 36 meter wingspan.

That's going from a length:span ratio of 0.86:1 to 1.17:1, you think those sort of airframe changes don't make for a plane that flies differently?

Maybe the whole notion of a "common type rating" is foolish, and pilots should need to re-train from scratch for the smallest of changes. Change the paint job? New type!

There's a lot of "the engines moved!" discussion around the 737 MAX which seems to be ignorant of decades of significant airframe changes not impacting type, to little apparent ill effect until now.

1. https://en.wikipedia.org/wiki/Boeing_737_Next_Generation#Spe...

2. https://en.wikipedia.org/wiki/Boeing_737_MAX#Specifications

I think it's all about how far off the mean you are.

Consider cars: You can get most full-size sedans with either four or six cyliner engines, manual or automatic transmission, and regular or sporty suspensions. That's potentially eight different sets of handling characteristics. But they're all going to be in a fairly narrow cluster of "this still drives pretty much like a Camry." When you decide "instead of the six-cyliner engine, let's drop in a 700 horsepower turbocharged V8", it's no longer anywhere near that cluster.

The question is whether a Camry with that V8 engine is as different from the less powerful of a Camry variant as it is from a Ford F-150. That's what the type rating is about.

The 737-100 had 62 kN of thrust, the 737 600-900 up to 120 kN[1], that whole line (and beyond) shares the same type rating.

1. https://en.wikipedia.org/wiki/Boeing_737#Specifications

> These engines moving made the plane more vulnerable to a stall situation.

I don't think this is correct. A lot is being made about the engine move with regard to aerodynamic behavior, but it doesn't seem at all outside of the bounds of what is considered standard. Pilots report that a similar 'light stick feel' at high AoA is already present in aircraft like the 757.

It's not that the aerodynamic change was worse or better, it's simply that it was a change at all. MCAS was there to satisfy the type rating. MCAS is not anti-stall.

The crucial mistake appears to be the extreme failure mode of the system; it is permitted to input high stabilizer trim angles without limit. Without any kind of restriction, the failure goes from annoying (pull up on flight stick + fiddle with stab control until you solve it) to the deadly crashes we've seen where pilots are in extremely tricky situations.

The fix could be as simple as making MCAS cutout in the case of an AoA disagree (no real hardware changes here) as well as limiting the input of extreme trim angles.

> It's not that the aerodynamic change was worse or better, it's simply that it was a change at all.

It seems you are correct [1]:

> MCAS is a longitudinal stability enhancement. It is not for stall prevention (although indirectly it helps) or to make the MAX handle like the NG (although it does); it was introduced to counteract the non-linear lift generated by the LEAP-1B engine nacelles at high AoA and give a steady increase in stick force as the stall is approached as required by regulation.

[1] http://www.b737.org.uk/mcas.htm

> MCAS was there to satisfy the type rating. MCAS is not anti-stall.

MCAS's only observable intervention is to push the nose down to prevent stall, which means it is by definition anti-stall.

Boeing says MCAS is an acronym for "Maneuvering Characteristics Augmentation System", but a better name for MCAS is "Machine Controlled Anti Stall".

https://en.wikipedia.org/wiki/Maneuvering_Characteristics_Au...

While the effect of pushing the nose down is an all-too observable effect, that its purpose is stall prevention is not directly observable.

According to this article[1], the intended purpose was to restore the back-force needed to put the airplane in a stall, as the effect of the new engines was to make the control feel lighter at high AofA. The article also discusses the certification requirements with regard to acceptable handling characteristics.

FWIW, Boeing CEO Dennis Muilenburg is quoted in [2] as saying that "When you take a look at the original design of the MCAS system. I think in some cases, in the media, it has been reported or described as an anti-stall system, which it is not. It's a system that's designed to provide handling qualities for the pilot that meet pilot preferences.

"We want the airplane to behave in the air similar to the previous generation of 737s. That's the preferred pilot feel for the airplane, and MCAS is designed to provide those kinds of handling qualities at a high angle of attack."

Of course, the elephant in the room not being mentioned here is whether Boeing's primary motive for replicating the handling characteristics of earlier versions of 737s was an overriding concern with avoiding pilot training.

[1] https://leehamnews.com/2019/02/15/bjorns-corner-pitch-stabil...

[2] https://www.businessinsider.com/boeings-ceo-on-why-737-max-p...

One of the requirements for an airplane to receive a certification is that the pilot needs to put more and more pressure on the stick to achieve higher and higher angle of attack. If at some point the airplane starts to pitch to higher AoA without extra pressure from the pilot, that's a big no. Reason: otherwise it would be all too easy to inadvertently enter a stall condition.

Boeing 737 MAX without MCAS violates that requirement (caused by the lift generated by large engine nacelles in front of the wings). MCAS is indeed designed to restore that required back-force. Back-force that is required to prevent stalls.

I suppose one could debate whether the stall prevention effect of MCAS is direct or indirect. But I don't think it's debatable that it is designed to comply with a certification requirement that's intended to help prevent stalls.

You have a point, though, from what I have read, I do not think the airplane would become unstable prior to the stall, merely less statically stable than its predecessors.

Boeing may be denying that MCAS has a stall prevention purpose only because to say so might put it in the critical systems category, requiring additional training. If so, this would apply as much to the fix as it does to the original version. To acknowledge that it has a stall prevention function might require an additional AofA sensor as well as additional training.

The MCAS may not have been designed as an anti-stall system, but that doesn't necessarily mean it functioned according to design. The possibility for multiple activations integrates the control response, converting feedforward control into a closed loop (it will continue to act on the trim until the AoA decreases). Somewhere a decision has been made about a control system without requisite knowledge or understanding of the consequences, and this made it through design validation, testing and certification. That is highly disturbing, as there is no certainty that MCAS is stable in any circumstances where the pilot is making manual trim adjustment.

> It's not that the aerodynamic change was worse or better...

Having the control get 'lighter' (more sensitive to increased back-force) as one approaches the stall is definitely an undesirable characteristic, as it increases the risk of a distracted pilot stalling. While a change in the opposite direction might have been problematic (insofar as additional training is a problem), the way it actually goes is more likely to prompt the FAA to require something be done about it.

> There was a safer configuration as an optional extra purchase;

Forgive me if I'm missing something but these extra options are AoA cockpit indication and AoA discrepancy alert when two sensors disagree.

They don't alter software, MCAS would continue relying on just one sensor regardless of this indication. It's just an extra bit of information for pilot's decision making.

Sounds to me like another hack over the hack hardly adding much extra safety.

How hard would it be to add two more sensors to every plane? I'd imagine insanely expensive but this is clearly the ideal solution in addition to whatever patches they can do via software and existing hardware/controls in the whole plane.

These planes cost nearly $100M each; how can adding another AoA sensor the size of your hand be that much in the grand scheme of things? https://i.kinja-img.com/gawker-media/image/upload/t_original...

Note that the 737 already has two such sensors, but only consults one at a time for MCAS, so there'd be a software change required in addition to adding a new sensor.

I'd just imagine coordinating with every airport and airport mechanic team to go through this process, have some integration work with the MCAS which has to be done very carefully and thoroughly. Everything is more expensive when you have a super high level of risk management and are working with large bureaucratic organizations like airlines and the FAA.

But yes it's certainly not impossible sounding. It's like a minor recall where the planes get fixed on site.

Hundreds of people are already dead because of this. It's the very minimum they can do to prevent more deaths. Whatever the cost is of adding another sensor will be less than the cost of another crash.

Surely they can predict the expected/likely value of an AoA sensor with all of the other telemetry available to an aircraft computer. Surely in combination with software fixes to ensure that both sensors are factored in, they could augment with that computed value to pick a sensor in the case of disagree.

If the needed telemetry is already exposed to MCAS, it could all be fixed in software.

MCAS will fly the aircraft into the ground, and has already killed >300 people. These sensors are safety-critical and should not be cheaped out on. A software-only fix is not good enough when the standard in the industry is to have triply redundant systems for safety-critical systems. This is one of those things we learned at the cost of a lot of blood.

This doesn't solve the problem completely. What if two of the sensors fault the same way? What if the computer turns off, will the pilot be able to do what MCAS does, manually?

Maybe it would be better just to use old time-tested design instead of saving small money at the cost of safety.

Reply on news.ycombinator.com