[sfilargi]

I urge people to read the discussion by pilots regarding the 737 MAX.

https://www.airlinepilotforums.com/safety/120514-ethiopian-7...

It all comes down to this:

"There are far too many aerodynamic bandaids that are permitted to pass the current standards. Not just this particular airplane, but a whole bunch of airframes. If the basic aerodynamics won't pass without the pushers, pullers and now AOA induced changes to primary and secondary controls then a new design of the wing platform should come into play."

The way I interpret this, is that the plane should never have gotten the green light to fly.

More info about the MCAS here: https://theaircurrent.com/aviation-safety/what-is-the-boeing...

[Someone1234]

Pilots have been pushing back hard on the narrative that this was simply pilot error.

The crux is that safety agencies never mandated training on these new systems, and new procedures weren't created with them in mind. Worse still procedures from older models of the same aircraft (such as automatic overriding of auto-trim) were removed without re-training on that either.

Lion Air had to repair the AOA sensor multiple times (replace, then flush), but a single sensor failure should not bring down an aircraft; and if the AOA sensor is that safety critical then why did Boeing put two of them instead of three (i.e. for cross-checking readings)? Either it wasn't safety critical and Lion Air's actions are reasonable, or it was and Boeing cut costs on safety.

So the justifications blaming either the pilots (who didn't get training, because safety agencies told them it wasn't needed) or maintenance (who were repairing a non-critical sensor that turns out to be safety critical) are weak.

[linuxftw]

> Either it wasn't safety critical and Lion Air's actions are reasonable, or it was and Boeing cut costs on safety.

This is an excellent point. Boeing can't have it both ways.

[rocqua]

I recall reading on HN that a second AOA sensor was an option.

[Someone1234]

If the AOA sensor is safety critical they need three, rather than two.

The inherent problem with two is if one is feeding false data, you don't know which one, whereas if you have three (or more; but an odd number) you can cross-check the data and drop the faulty one.

It is a very common strategy already for commercial aviation and is called "voting logic."

> A more reliable form of voting logic involves an odd number of three devices or more. All perform identical functions and the outputs are compared by the voting logic. The voting logic establishes a majority when there is a disagreement, and the majority will act to deactivate the output from other device(s) that disagree. A single fault will not interrupt normal operation. This technique is used with avionics systems, such as those responsible for operation of the Space Shuttle.

But the real crux here is: Is the AOA sensor safety critical or not? If it can fail-safe then they can likely continue as it is currently designed. But if its failure state can cause an aircraft crash, then it becomes a safety critical component.

[AWildC182]

It's a bit more complicated than that even. The 737 was originally designed for a very different mission than it's being used for right now. If you find pictures of the original 737-200s they look very different from the MAX line of today. It was built in an era when it was assumed that 707 and soon after 747 class airliners would serve the hubs and then smaller 737s would serve the small regional airports. As such the 737 was designed with VERY low ground clearance such that it could offload without a ramp and generally be serviceable at these types of low infrastructure airports, hence the lack of wheel doors, the ovoid engine inlets and the generally low stance.

Fast forward to today where airport infrastructure is much more developed and these small/medium size airliners are being pressed into front line service including intercontinental routes. The aircraft has changed drastically to accommodate these changes through the years, enough that it may be time for a clean sheet design. They've changed just about everything on the air-frame from the fuel load/cabin length/wing to the avionics to make this all work.

Now, the other side of that coin is with systems. In theory this should be fine, but obviously isn't. It's hard to differentiate bandaids from regular systems and if either fails then safety is compromised. Obviously the amount of unnecessary systems should be minimized but as time goes on more systems WILL be added to gain the rewards of automation, which is a good thing. As such, we need to educate pilots on ALL of the systems, and rigorously test them before they enter service.

Additionally, if you do as the pilots want and achieve very high aerodynamic stability through the air-frame instead of stability control systems (fly by wire essentially) it reduces the aerodynamic efficiency of the airliner, particularly with current conventional designs.

[zanmat0]

>if you do as the pilots want and achieve very high aerodynamic stability through the air-frame instead of stability control systems (fly by wire essentially) it reduces the aerodynamic efficiency of the airliner

It's crazy to me that that would be an acceptable compromise.

[namirez]

Fly-by-wire means the control surface actuators are connected to cockpit controls electronically rather than with hydraulic lines or metal cables; it's not necessarily related to stability and control augmentation system.

With regard to the other point, I don't think anyone is advocating for very high aerodynamic stability. That would be a B52 carrying nuclear weapons. It was designed to be extremely stable and forgiving. That being said, you don't want to rely solely on stability augmentation for trimming an airliner.

It reminds me of Air Canada flight 143, the pilots lost both engines and power. yet they were able to land the plane safely on an abandoned airport. I'm not sure if that would be possible with a 737 Max.

[sandworm101]

Yes it would. There are backup systems to keep things working even with both engines dry (ram air turbine etc). In fact, if you really want to stretch our a glide, all those automated systems are probably a good things. They will keep the aircraft more perfectly trimmed for a glide than the pilots ever could by hand.

https://en.wikipedia.org/wiki/Ram_air_turbine

[StreamBright]

And in case of the electrical system being down how do you control the flight when you have fly by wire controls?

[zrobotics]

If the electrical failure is severe enough to lose control authority, it seems just as likely that a hydraulic system would have failed. These planes are just too large to operate the controls mechanically, so in practice there is just as much to fail in a hydraulic system as electrical control, since both require power.

[sandworm101]

>>And in case of the electrical system being down

That is what the RAT is for, alternative electrical power. If the entire electrical system is down, ie electrons no longer flow anywhere anyhow, then everyone is doomed. But that is up there with the tail falling off. The are no backups for the wings/tail either.

[cududa]

Yeah as long as the sensors actually work

[AWildC182]

How so?

When I say stability control, we're not generally talking about unstable or "relaxed stability" airframes where the system failing would cause a pitching moment to accelerate rather than converge and the aircraft would tumble and disintegrate. From an efficiency and handling standpoint, this would be ideal, but it's only used in tactical military aircraft where the crew can bail if there's a problem.

In most cases, we're talking about preventing stall in a swept wing aircraft. Swept wings are necessary to cruise efficiently beyond ~300mph at high altitude so they have to stay obviously, however they have VERY poor stall characteristics. As such, we have to do some things to prevent the aircraft from stalling such as playing with trim, using a stick pusher, etc.

[mehrdadn]

> Swept wings are necessary to cruise efficiently beyond ~300mph at high altitude

Layman here, but 737, 747, etc. don't have swept wings, right? So they all cruise inefficiently... but are in fact stable... which is the opposite of what you wrote earlier? Sorry, I'm just really confused.

[stickfigure]

You're picturing a fighter jet or something with severely swept wings. Do an image search - 737s, 747s, et al do indeed have gently swept back wings. They don't stick straight out at 90 degrees like aircraft from the piston era.

[banku_brougham]

Totally off topic but I see some of those WWII era piston craft flying and its quite a nostalgic experience.

[mehrdadn]

Ohh I see, okay thanks.

[dragonwriter]

> Layman here, but 737, 747, etc. don't have swept wings, right?

They do, in fact, have swept wings.

[anovikov]

Obviously stability has to be achieved through fly by wire tech. Doing it through natural aerodynamic stability is a waste of resources of insane proportions as such airframes induce more drag and burn more fuel. If this sounds too scary for people in a forum of software developers it only puts a shame on our profession, from ourselves.

[XMPPwocky]

The software itself isn't necessarily the issue, though- it's also all the sensors and actuators involved.

Suppose, for instance, that an aircraft needs more yaw stability.

There's all sorts of design choices that could be made, but consider either A: a larger vertical stabilizer or B: automatic application of the rudder to damp oscillations.

The vertical stabilizer here is essentially a bit of metal. We know very, very well what can go wrong with bits of metal. Fatigue, corrosion, manufacturing defects, bad repairs... But, in 2019, we've pretty much figured out the failure modes of big bits of metal on an aircraft, and we generally know how to prevent and/or minimize them.

Now, the dynamic stabilization approach. We'll need gyroscope data (from the IRS, probably), a software model of flight dynamics (which almost certainly already exists and is running), and possibly faster servo valves for the rudder actuator.

This can work! We can formally verify that the control system we've created damps oscillations throughout all normal flight regimes. The gyroscopes are already redundant and well-tested. And you might not even need the faster servos.

Problem is, now avionics failures are even scarier. Will the stabilization here still operate when you get dropped into secondary mode? Probably not- so now, in unexpected situations, pilots need to keep in the back of their minds that yaw oscillations are more possible, that they may need to damp them manually, etc, etc.

Now you throw in some extra factors- turbulence, IMC (which would probably make detecting those oscillations manually that much more stressful), and trying to solve whatever problem dropped you into secondary mode in the first place... and you have something a bit concerning!

A bit of metal won't do that to you. We can make much better estimates of a bit of metal's reliability, and its failures are also less correlated- they aren't much more likely to crop up when you already have another problem.

[anovikov]

Well military jets have been doing exactly that - maintaining stability through software on inherently unstable planes that would break up even in straight and level flight in a split second if computer crashes - for 40 years now. And Boeing builds both kinds of planes so they have the experience.

[joe_the_user]

No one knows better than software engineers how difficult it is to make inherently reliable software and how much complexity can add to the difficulty of making reliable software.

That said, the cost of not using latest fuel efficient airplane would indeed be huge and the actual reliability of modern aircraft is very high and has been increasing over the years in which fuel efficiency also increased.

Sometimes, human can hit on a formula that produces objects that satisfy all the given parameters more fully rather than compromising on any of the requirement. But it's quite plausible that these formulas cannot be milked forever - thus the "Max" may be the point where tradeoffs stop working.

[cco]

Could you clarify your assertion that it would be massively more expensive?

A quick look at the numbers suggests that a 737 MAX 8 is about 10% more efficient on fuel burn compared to a 737 300. That is not "massive" in my book and I'm more than happy to pay a little bit more per ticket if it means a higher safety margin.

Did you mean something older and less efficient than a 737 300?

[edoloughlin]

such airframes induce more drag and burn more fuel

As a curious bystander, I assumed using fly by wire tech to achieve stability would involve using control surfaces, which increase drag by their nature. How would an airframe that's naturally stable and doesn't require control inputs burn more fuel?

[AWildC182]

It's more about preventing a stall with a swept wing which is needed to achieve high mach numbers.

That said, an easy (but different) case to visualize is a traditional tailplane. The center of gravity on an airplane is in front of the wing so it wants to pitch down slowly. The tail pushes DOWN in the back to keep the nose up. Nose heavy planes are stable and forgiving but you induce drag because the wing needs to supply some lift just to counteract the tail which is producing negative lift. If you move the CG backward, you get less stability because the airplane wants to pitch up/down more violently with a control input but you have less negative lift from the tail.

[zaroth]

That’s a great explanation, even if it is oversimplifying.

We don’t build planes with training wheels anymore because the performance cost was too high. Planes are still the safest way to travel even without the training wheels.

I don’t think 737 MAX 8 pushes the envelope too far. I think they screwed up on re-training the disengage, and they may have screwed up on redundancy by only using a single AoA sensor, but I also am guessing the latest crash has absolutely nothing to do with trim.

[rocqua]

So the stable airframes we know are stable because a dynamic aerodynamic force opposes a static one.

Makes sense then, that those opposing aerodynamic forces induce drag.

[fnordprefect]

> the ovoid engine inlets

The original design of the 737 did not have ovoid inlets.

You can see regular circular nacelle inlets on the 737-100:

https://secure.boeingimages.com/archive/Boeing-737-100-2JRSX...

and on the 737-200 here:

https://secure.boeingimages.com/Assets/V2/jrZYYwCXohU1rDmk4e...

The ovoid inlet design was introduced with the 737-300, when the engine was changed to the CFM56.

[AWildC182]

The ovoid engines were a result of high bypass engines being added on the 300. The low bypass turbines on the older models was much smaller. These were then removed on the max because the engine was mounted higher and further forward on a low profile pylon.

[StreamBright]

Are you saying that the lack of proper response to changed requirements is the primary source of 737MAX's issues?

[AWildC182]

Maybe? Let me leave you with one other tidbit though. Beyond the requirements, airframe changes, and added electrical stuff, to fly the 737s you need a type rating and that rating is basically an education on all systems and procedures for the airframe. Boeing worked hard to make all aircraft from the 200 through the MAX fall under one type rating so if you get certified to fly an old low bypass 200, you can hop out, walk across the tarmac to a MAX and take off with another load of passengers. Obviously almost nobody runs the 200 anymore but the later aircraft are all still operated in some capacity and having one rating to rule them all makes it cheaper for small operators with mixed fleets to afford the training costs. In doing this, Boeing had to make the basic "UI" for the aircraft all the same, regardless of model. I'm not typed in the 737 but from what I've heard, it's resulted in a lot of user flow and documentation idiosyncrasies, particularly in the MAX lineup which could be part of the issue here. All that said, the trim motor disconnectors have been in the same place for most of the aircraft's history I'm told and hitting them would have likely prevented the Lion Air accident.

[pasta]

Trump tweeted that planes have become too complicated and that the old and simple form is much better.

His tweet sounds dumb but there is some truth in it.

As you say, planes and procedures have become very complicated. And I think there are only two options: making planes simple again which make them less efficient or let computers fly the plane and make the interface simple(r).

If you look at the rockets of SpaceX then you can say they are the extreme form of fly by wire and very instable when it comes to aerodynamics. But computers can land them within centimeters when they fall out of space.

So maybe that will be the future. Planes that are very efficient instable flying 'rockets' that are controlled by computers.

[erokar]

> His tweet sounds dumb but there is some truth in it.

There really isn't. Automation is part of what has made flying safer over the years. Also, compare the cockpit of an Airbus with e.g. an old B737, the 300 series for instance. The Airbus cockpit is much simpler, in the sense that there are less gauges and knobs for the pilots to be concerned about. Automation has, over all, made things simpler and safer.

[theoh]

Citation needed, please.

The most convincing popular article I've read on this topic is https://www.vanityfair.com/news/business/2014/10/air-france-...

It's far from clear-cut that the way automation is happening is advisable, however conservative it might appear to be, and I'm sure you'd agree that there are many confounding variables that make it difficult to say just what is responsible for the trajectory of aircraft safety. There's not much of a control group of advanced modern aircraft which omit automated features.

[sokoloff]

Almost every (or perhaps every?) swept wing jet has active/positive anti-stall systems, at least a shaker and often a pusher.

The wings need to be swept for efficient travel much over Mach 0.6 and these aero aids are needed for swept wings.

At this point, pushers and shakers are well-accepted fixes for aero that is not inherently recoverable.

[VBprogrammer]

Stick pushers go all the way down to the PC12 (a single engine turboprop). Honestly there is no putting that genie back in the bottle. Getting benign stall behaviour out of a highly efficient wing is very difficult.

[jakelarkin]

"the plane should never have gotten the green light to fly."

this is an overstatement. airframe fuel efficiency is a undoubtable good thing vis a vis climate change, costs, etc. Obviously they've reached a point were the aerodynamic profile of a modern, efficient airframe is difficult to control via manual pilot input alone in some scenarios. This was the case for stealth technology with fighter/bomber designs.. the B2 for example has no vertical stabilizer and would not be controllable at all without fly-by-wire. Of course pilots will lament complexity and the loss of manual input. Regardless, the FAA wanted MCAS in the 737Max. Augmenting human input in the face of instrument failure and possible human failure is an extremely hard problem and uncharted territory for the industry. Doesn't at all mean its a not a worthy goal or that the designers or regulators had ill intent or negligence.

[erokar]

That's not really the problem with the B737 MAX though. It's not inherently unstable like e.g. a fighter. The issue is that they had to fit the engines in front of the wings, and this will create a significant pitch-up if thrust is added abruptly, e.g. in a go-around.

To counteract this they introduced the MCAS system. They would not have needed this if they hadn't "retrofitted" big engines on an old airplane design, but instead started from scratch. The B737 MAX is not really a modern aircraft, but a heavily modded old design.

[calf]

That's interesting to know, I think the 737 Max looks very kitbash because of the way the engines dangle in front of the wings.

[paulmd]

The problem here isn't that a 737 MAX style design is inherently unstable. The issue is that the larger engines really needed longer landing gear and other significant airframe changes, but due to demands from Southwest that it remain within type-certification for the 737 (to avoid the costs of pilot retraining) some unfortunate compromises were made that affected the aircraft's behavior.

You can design an aircraft just like this that won't have those characteristics. You'll just need to pay to get it certified and then airlines will have to pay to train their pilots. Instead, Southwest wanted the band-aid fix, and Boeing obliged them.

[usrusr]

An aerodynamically sound redesign to accommodate the high bypass engines would have been just as fuel efficient as the version with confusing software band-aids.

If it is cheaper to invent something like MCAS than to properly adapt the airframe, then maybe the processes that would be used for the latter are ripe for some efficiency optimization.

[dukoid]

When I see cockpit videos, the pilots tell each other what they do / run checklists together... Does the MCAS do the same, i.e. announce "stall risk detected, increasing stabilizer trim by 2.5 degree to xx degree"?

[erokar]

No, but the pilots will hear/see the trim wheel moving.

[metanoia]

Inattention to autopilot modes has killed before. So much focus is put on pilots recognizing and confirming flight mode annunciator mode changes (such as change of autopilot or autothrottle state) has been put into place to stop that kind of accident.

The lack of feedback from the MCAS system is probably the killer here.

How am I supposed to know that MCAS is operating, and how do I know when to hit trim cutoff switches to override it? You don't want to ever be asking "what the heck is the airplane doing now?". Watching the trim wheel to check if it's spinning nose down all the time isn't going to work.

[erokar]

The Lion Air pilots were not even aware of the existence of the MCAS system, because Boeing at the time did not include any information about it in its manuals.

The behavior would be similar to runaway stabilizers, though, for which B737 pilots have memory items to perform (turn off the trim). This would have solved that problem. However, several other warnings and alerts, like stick shaker, might have been going off at the same time, making the situation chaotic and problems hard to diagnose.

[consp]

An additional problem is that if it fails (the MCAS) the airplane is low, in full thrust during take-off and the pilots have zero room for error as the airplane is trying to dive into the ground (as in the LionAir flight).

[craftyguy]

Reading the posts there is a lot like listenning to 'retired generals' on <insert entertainment "news" network here> who haven't seen action/training in decades talk about modern tactics, equipment, and situations as if they magically have been informed by companies/players in the field they left (hint: they haven't).

I'd rather wait for formal investigations (e.g. NTSB-style) before jumping to any conclusions.

[jostmey]

I interpret this as an indication that the United States policy and law is run by Wall street and is corrupted. Boeing didn't want to develop a new airplane, cut costs, and doesn't want to lose money, so the FAA is not allowed to ban the plane