Hacker News new | ask | show | jobs
by WalterBright 1519 days ago
> the Max crash is clearly due to corporate greed

Is it? The single path weakness in the MCAS design was not a cost saving measure. I've never seen an explanation for why this mistake was made.

2 comments

The airframe was changed significantly, creating the need for the whole MCAS solution — why? Because this was seen as a solution to avoid a recertification of the airframe, which would mean pilots had to re-train, which would mean airlines wouldn't buy, which means money would not flow.

Avoiding this recertification was the only reason MCAS was chosen instead of designing an airframe in such ways the now bigger engines actually have their center of gravity where it is expected to be.

This was ultimately a cost saving measure. Boeing could not be bothered to recertify the airframe purely for comercial reasons, not because it objectively made sense.

There is nothing wrong with making an airplane behave like the previous version. In fact, it enhances safety, as pilots can and do make errors when under stress they do the right thing for the wrong airplane. Making airplanes predictable and consistent with existing training is a safety enhancing practice.

I worked on the 757 design, which was designed concurrently with the 767. A lot of effort was made to make them behave in a common manner, even though they were quite different airplanes. This makes perfect sense.

It's the same reason the steering wheel and pedals on your car are laid out the same and do the same things across nearly all very diverse cars. And yes, carmakers adjust the handling characteristics to be predictable and not need the drivers to have additional training.

Boeing had originally proposed a new small aircraft (with carbon fiber), but the airlines did not want this as it would have higher operations costs to have two different types of aircraft, so Boeing had to come up with a new 737, and the MAX was it.
It was made because implementing a dual path system would have required simulator training. Boeing wanted to avoid that at all costs as a value pitch.
A dual path (along with the other changes made to the MCAS implementation) would not have required simulator training.

(With dual path, MCAS would have simply turned itself off if the two inputs disagreed.)

That was not my understanding, but the source I heard about the reasoning from was the 60 minutes expose.

https://m.youtube.com/watch?v=QytfYyHmxtc

Between 35-36m-ish. 35:30 I think.

Boeing was claimed to have "known the FAA would not certify a dual sensor system without Level D simulator training".

This was from an insider at the time, and admittedly, I've not heard of an identity being put to them, but that signal was claimed to have been there.

There is also corroborating evidence that the Chief Technical Pilot actively dissuaded customers who asked for simulator time anyway, characterizing it as unnecessary. I don't have those at my fingertips right now, and unfortunately, my memory is failing me as to whether or not an "oh shit" moment was had at some point as to whether the Chief Technical Pilot had mischaracterized the system to regulators.

I just remember I thought it was awful convenient at the yime that this Chief Technical Pilot had all the hallmarks of a scapegoat for management to start piling blame on, and being glad he got independent counsel instead of relying on Boeing's General Counsel.

Thanks for that bit of information, I didn't know that. It sounds like it could be true. But being uncorroborated, and considering all the false information swirling around the issue, I'd want some confirmation.

I watch every episode of "Aviation Disasters". On more than one, the pilots would get some warning light and would ask each other what it meant. That implies that simulator training is not required for every warning light.

I figure we'll find out more if/when a criminal case is finally brought and prosecuted, until then, I consider anecdotally credible. Here's those texts and articles btw...

https://www.reuters.com/article/uk-ethiopia-airplane-forkner...

https://www.seattletimes.com/business/boeing-aerospace/why-b...

Texts: https://www.documentcloud.org/documents/6497959-Boeing-Text-...

It seems they never leveraged anything more from this supposed whistleblower, so until more is seen, it's kinda moot. Still thought Forkner was a fall guy for bad management though.

That, of course, immediately raises the question of why, then, this was not done.

There is a proximate answer that still does not get us to root causes: An MCAS failure was rated as a Major condition as opposed to Hazardous, in which case the regulations allowed (but did not, of course, require) a single source of input.

This rating was arguably justifiable for the 737 MCAS in its original form, but its power had to be increased significantly after flight testing revealed the original version to be inadequate.

As it happens, the 737 MAX airframe was not the first use of MCAS: the KC-46 also has it. Despite the fact that this system is less powerful than that which was fitted to the initial production 737 MAXs, it uses two AofA sensors. There is clearly a strong and obvious engineering case for doing so, so simply observing that Boeing did not have to do so does not exhaust the questions that should be asked.

I have seen it stated in several places that using two AofA sensors would have required a warning in the case of their being in disagreement, which in turn would require it to be mentioned in the AFM, which might have prompted a reevaluation of the no-training decision, either directly or through a reevaluation of the risk classification. Unless a smoking gun has been found, Boeing can stonewall on whether the training concern suppressed a full and objective evaluation of the risks posed by MCAS (especially after its strengthening), and thereby improperly influenced design decisions (among other issues), but the concern is obvious to everyone except those who want to avoid considering it.

> That, of course, immediately raises the question of why, then, this was not done.

Which I raised in the antecedent post.

I did not write that Boeing "did not have to" have dual sensor input. I said if they did have dual sensor input, and had done the other changes to the software, in my not-so-humble opinion additional simulator training would have been entirely unnecessary.

The other question I have is why two sets of pilots did not understand what the STAB TRIM CUTOFF switch was for, despite it being in a very prominent position on the console and is supposed to be a "memory item", meaning the pilot should not have to look it up in an emergency. That indicates inadequate training, whether the airplane had MCAS or not.

Keep in mind that the first MCAS incident, which is never mentioned by the press, landed safely because the crew simply turned off the misbehaving trim system. That crew didn't even seem particularly concerned about it after they landed.

>> That, of course, immediately raises the question of why, then, this was not done.

> Which I raised in the antecedent post.

You did, in the sense that you wrote "I've never seen an explanation for why this mistake was made." That does not mean it is somehow wrong for me to also make that point as a prelude to continuing that line of thought.

> I did not write that Boeing "did not have to" have dual sensor input...

And I did not say that you did. I pointed out that this would not be a full answer to the question that both of us raised.

> ...in my not-so-humble opinion additional simulator training would have been entirely unnecessary.

I very much doubt that Boeing was at all concerned about what you or I think. It is rather more plausible that it was concerned about what the FAA might think, especially if the FAA also understood the extent to which MCAS's power had been increased.

And nothing else you have written here has any bearing on the possible motives behind Boeing making a decision that you yourself call a mistake - one which was made before these incidents.