Hacker Newsnew | past | comments | ask | show | jobs | submitlogin
The world pulls the Andon cord on the 737 Max (theaircurrent.com)
68 points by MilnerRoute on March 17, 2019 | hide | past | favorite | 114 comments


It's hidden at the end, so I thought I'd put it up here: an Andon cord is a way to notify management of issues in the assembly line, typically by pulling it: https://en.wikipedia.org/wiki/Andon_(manufacturing)


Seems like such an odd name for a cord that “stops” production... I imagined by the naming that the world must have resumed flight of the 737 Max or something like that. “And.... on!” or a race “and... go!”. Good to know, I wasn’t aware of these in factories.


It's derived from a language other than English. Japanese? Something...


Japanese: 行灯. It’s the classic Japanese lamp, I guess pressed into use as a warning signal in factories? https://en.wikipedia.org/wiki/Traditional_lighting_equipment...


I think it is the wrong word, it is a fundamental design problem and back to the drawing board, not a matter of fixing some quality control issues.

I think the word they were looking for was 'Samsung Note 7' not 'Andon cord'.


It’s common term in Lean circles. For people who (like me) prefer not to use Japanese terms when an English one will do, “stop the line”.


> A warning light that would’ve alerted the crew to the disagreement wasn’t part of the added-cost optional package of equipment on Lion Air’s 737 Max aircraft.

I'm not an aviation expert, but why should something that seems as important as an indicator of system malfunction be an optional package instead of builtin?


I agree that the AoA disagree alert (and AoA gauges) should be standard. If you've watched any of Capt. Vanderburgh's videos on youtube you'll know he's got a fair amount of disdain for the lack of AoA indicators on most Boeings.

But, in all fairness, even without the "AoA disagree" indicator there were telltale symptoms on the Lion Air bird that something was wrong with the alpha vane (the sensor in question). The most obvious was that only one stick shaker was going off (each control column has a shaker which only takes input from the alpha vane on its side). That's a pretty obvious symptom.

However on the previous Lion Air flight there were two other symptoms written up in the maintenance log[1]: "IAS (indicated air speed) + ALT disagree shown" and "(elevator) FEEL DIFF PRESS light illuminated". On the MAX, both of those systems take angle-of-attack into account (which is new for the MAX, IIRC).

As an aside, American Airlines 191 had a similar situation. Their DC-10 had only a stick shaker on the captain's control column, a second stick shaker was a paid extra. Boeing, of course, bought McDonnell Douglas years later.

1: http://www.jacdec.de/WP/wp-content/uploads/2018/10/2018-10-2...


Out of curiosity how is one of two stick shakers activated obvious when each is connected to a different person? Is it common to ask “hey, is your stick shaker going too?” it seems possible that each pilot would assume the other was feelig the same feedback from the stick and go on troubleshooting elsewhere, but I have no experience with this.


Out of curiosity how is one of two stick shakers activated obvious when each is connected to a different person?

Stick shakers are noisy, but I suppose you would also ask and cross check the instruments. If only one stick shaker goes off you'll probably get various "something disagrees" lights going off, which should prompt you to check. Take this for instance:

https://aviationweek.com/awin/boeing-addresses-pitot-tube-an...


It’s when you keep warming up a 1967 architecture with as few as Possible changes so you don’t have to recertify. The whole 737 is preposterous and wouldn’t be legally certified if presented as a new airplane today.


> The whole 737 is preposterous and wouldn’t be legally certified if presented as a new airplane today.

In what way is it preposterous?


To cut a long story short, they put massive engines on an airframe not designed for it, causing "unusual flight characteristics" (the huge engines could generate their own lift, pitching the nose up) which they compensated for with MCAS. MCAS took input from an AoA sensor, and if this sensor provided incorrect input the nose of the plane could be pitched down aggressively during normal flight - a very dangerous occurrence especially soon after takeoff. To make matters worse, it overrides pilot input (i.e. pulling up on the yoke doesn't help - the system has to be switched off). An AoA disagreement indicator, which may provide timely alert in such situations, was an optional paid extra (should have been a mandatory safety feature). Without this indicator and in an emergency situation, it might be too late to save the plane before the pilot figures out what is wrong and disconnects MCAS. Additionally, information about the MCAS was initially left out of the plane's manual. One could ask, in what way is it not preposterous? There's no way it should have been certified in that state.


That’s the 737 Max, but the grandparent was referring to “The whole 737 was preposterous” - not just the Max model.


Yes, you're right. I can't say that I misread it, nor did I consciously make that assumption. Oh well, faulty heuristics.


I agree with you, but cars have optional packages for warning lights for lane changes and automatic braking. It’s not that hard to imagine.


The first thing I noticed about planes is they are not cars.

Seems an analogy that’d rapidly break down.


Well, you want to be witty, but that‘s exactly the point of an analogy: Make things that are different comparable, so you can come to conclusions about thing A even though you only have knowledge of thing B.

You might want to try to strengthen your argument by explaining why an analogy between cars and planes can‘t hold (one moves only in „2D“ vs. the other one moves in „3D“ for example)


that 737 costs 100,000,000

a plane crash kills a lot of people

The training to drive a car vs a 737 is Hugh


They both have alternatives (ie looking around you). What's the procedure for figuring out whether AOA sensors disagree when there's no indicator light? The sensors are probably used in numerous ways by the flight control software.


Those are compulsory... At least in Europe. Are there many cars in the US that don't have warning lights when braking? Jesus.


Automatic braking is optional. Braking lights aren't.


I'm not an expert at all either but wondering too why this can't be a notification on one of the screens, a SW feature I mean.


It's all about the Benjamins baby! Yes, there should have been a warning shown on one of many LCD displays in the cockpit, but Boeing decided that it has to be displayed by HUD system, which is an expensive upgrade.


So... they put in software (MCAS) to try and auto-assist in certain situations so that flying the 737 Max would respond like flying the current 737. But seems like an indicator light to show when the sensors that activate that system trigger isn't standard equipment & the sensors may very well have a bad baseline read before takeoff and the system kicks into gear and auto-crashes the plane if you don't know how to disable it. Yeah, I'm never flying in one of those things :-)


Pilots are trained in how to disable it - the stab trim cutoff switches are right there on the console. The mystery is why the pilots didn't follow their training.


https://www.aviation24.be/manufacturers/boeing/boeing-737-ma...

> Boeing issued a multi-operator message (MOM) explaining the MAX’s manoeuvring characteristics augmentation system (MCAS) “commands nose-down stabilizer” in certain flight profiles using “input data and other airplane systems.” MCAS is operated by the flight control computer and “activated without pilot input and only operates in manual, flaps-up flight,” and MCAS is not part of previous 737 designs.

> The Allied Pilots Association (APA) told American Airlines (AA) pilots in a message on its website. “It is not in the AA 737 Flight Manual Part 2, nor is there a description in the Boeing FCOM. It will be soon.”

> A multi-page document issued by the airline’s flight operations department that highlights the differences between the MAX and 737 NG does not mention MCAS or any other changes to the auto-trim system.

> A multi-operator message (MOM) from Boeing on Nov. 6 cautioned that “an erroneous AOA” can trigger automatic nose-down pitch-trim.

There are lots on indications that at least in the Lion Air case it was not in manuals or communications to pilots.

Further here:

https://www.wsj.com/articles/boeing-withheld-information-on-...

https://outline.com/https://www.wsj.com/articles/boeing-with...


For a pilot ignorant of MCAS, what he'd see is uncommanded stabilizer trim movement. The training says to stop that by throwing the stab trim cutoff switches. They're prominently located on the center console.

The pilot of the same airplane on the prior flight to the Lion Air crash did just that.


So this was just a Darwinian exercise, where the plane kept malfunctioning until it found a crew that responded incorrectly?

I hear you about runaway trim, but it seems that you are quite focused on the blades of grass and not looking so much at the lawn.

Nobody has given me an adequate answer to one simple question: what is the indicator the industry will use to determine when it has made the cockpits so complex that the complexity itself becomes a danger? Because we can play this game for a few decades more: manufacturers mod-up old planes with new software, extra training is added to the pilot's schedules, there are crashes where commenters in good faith can say "but that's an obvious part of any pilot's training". Repeat and rinse -- with the proviso that with each round the overall complexity continues to increase.

Technology developers, more than anyone else, are quite cognizant of the fact that we can create technology we ourselves cannot understand. Perhaps the aviation industry and the associated regulators somehow missed this?


I view it a bit like an engine failure. Jets have twin engines so they can keep flying if one quits. Pilots are trained to deal with an engine out. It doesn't particularly matter why the engine quit, just that the pilots know how to fly on one engine.

The pilots are supposed to know how to deal with runaway stab trim. It doesn't matter why it was running away, just that the pilots know how to deal with it. Whether it was MCAS or the autopilot or a short circuit, does not matter.

After it is safely back on the ground, then the specific cause of the failure can be ascertained and corrected.


With respect, I believe you are viewing this in far too simplistic a manner.

Let's take engine failure. When you're training twins, you're going to get one of the engines pulled on you quite a bit -- usually when you least expect it. That's because a lot of people died educating the industry to how important it is to be able to handle engine failure in all flight modes: takeoff, climb-out, cruise-climb, and so on. That reaction sequence has to be drilled into pilots to such a degree that there's no thinking involved.

But runaway trim? Seriously? Sure, you'll get the training, but in all modes of flight? Drilled into you until you can handle it in your sleep? No way. That's preposterous. We _thought_ we knew that those kinds of problems don't happen at weird times to cause people to die. So if you're flying along in cruise and you've got a runaway trim, somebody does a mental lookup -- which might take 3 or 4 seconds -- locates the breaker, then throws it. We do this other type of training a lot too, but there are tons of subsystems on your average commercial airliner. We don't train for that the way we train for engine failure. We've got huge reams of checklists in commercial cockpits dedicated to this kind of slower problem-solving.

So yes, in both cases a person could argue that training was either not given or not implemented by the crew. But that ignore the realistic limitations of trying to train crews on modern equipment. You simply can't do some kind of weird cross-tab grid where everything is trained everywhere and to the same degree. At some point the human factor has to come into play. People aren't robots. It looks like these accidents happened on takeoff/climb-out, one of the most busy and complex things a crew can do (not near the complexity of hand-flying the various instrument approaches, of course).

You gotta ask yourself: if I'm watching my turbine numbers, my airspeed, looking for traffic, the copilot's talking to the pax, and so forth? Would I catch a runaway trim right away? More to the point, if I missed it, would the ensuing chaos, _in some cases_ prevent me from being able to cognitively switch back to diagnostic mode? After all, we teach pilot when all else fails, fly the plane first. Add to that systems like MCAS that might exist in the software that the pilots are unaware of?

If these accidents turn out to be MCAS/runaway trim related, I would be interested in learning about the crew environment when it happened, specifically other issues taxing the pilots and whether or not the flight director was engaged.

So yes, sure. You can train your way out of this. At some point, however, you have to ask if the cost we're paying in lives is worth the lessons we're learning which all seem to boil down to "people are cognitively limited in many ways"


It's a good point, but the prominent placement of those cutoff switches, and the criticality of runaway stab trim, suggests it should be solidly there in training.

I'm sure the training issue will be prominent in the NTSB report.

Note that stall recovery is heavily trained, but airliners still crash because the pilot reflexively commands nose up in a stall instead of nose down. And the MCAS system is there to nose it down in a stall.


Wait, are you saying that the aircraft actually exhibited the same failure in the prior flight but the pilot overrode it, and then they let it take off again without warning the new pilots?


The previous flight before the disaster actually made an emergency distress call to return back but after disabling the automatic system decided to continue onwards and did so with no further problems in the flight.

Pilots are given all this information and are meant to read it before takeoff but there is no way to enforce that.

Maintenance logs show the AoA vane was replaced, but Lion Air has a sketchy history with maintenance and what's written in the logs doesn't always reflect the reality, they are one of the cheapest airlines in the world and need to keep planes flying. I'd say that's likely the root of the issue combined with pilots not following the procedure books when faced with anomalous behavior.

https://www.airlineratings.com/news/lion-air-plane-fault-fou...


That's what I read in the newspaper at the time.


> The training says to stop that by throwing the stab trim cutoff switches. They're prominently located on the center console.

Not so. First: before Lion Air accident, nobody knew there is a new device that can move the controls that way under these conditions (in that phase of flight etc). The whole device was kept secret by Boeing. Second: the pilots had the trained reflexes what they are to do, and with these, there are more steps to try to overcome such movements before the decision to use the switch. And that’s exactly what the pilots did: attempted the steps before. Which seemed to help, but MCAS kept misbehaving. As the seconds matter, then it was to late.


In the Lion Air crash, they struggled with the issue for 11 minutes, not a few seconds. The Ethiopian one, over 6 minutes.

The reason the stab trim cutoff switches are there is so the pilot can stop runaway trim. The switches are prominently placed.

I expect the failure of the pilots to throw those switches to be prominent in the eventual NTSB report on the accidents.

The second accident would be especially perplexing because surely the pilots would have known about the Lion Air crash. If I was a 737MAX pilot, I'd be keenly interested in other crashes in the same aircraft, so I could ensure it wouldn't happen to me. Wouldn't you?


How your “11 minutes” claim fits to this:

https://www.nytimes.com/interactive/2019/03/13/world/boeing-...

Have you seen the graphs? There are 20 seconds intervals. They “fight” the plane, then something (the investigation is still on what) makes it worse again.

That’s what confused the pilots: the misbehavior repeats after they think the plane returned to normal.


Yes, I've seen the graph. They had minutes, not seconds.


In which they thought each time „it‘s OK now.“ That‘s not what they were trained for, that a device can turn itself against them on again and again.


I beg to differ. If I had an intermittent failure that would nose the airplane down, you bet I'd turn it off. I wouldn't want it to happen when I was close to the ground. I would have shut it down the second time it happened.

It's like if an engine is on fire, and I shut down the engine, and the fire goes out. There's no way I'm going to think "It's OK now, I can restart the engine." No way in hell.


I think you still observe this with the benefit of the hindsight of what you know already killed 350 people.

However:

https://news.ycombinator.com/item?id=19420964

"pilots and aviation experts say that what happened on the Lion Air flight doesn’t look like a standard stabilizer runaway, because that is defined as continuous uncommanded movement of the tail."

"On the accident flight, the tail movement wasn’t continuous; the pilots were able to counter the nose-down movement multiple times."

"In addition, the MCAS altered the control column response to the stabilizer movement. Pulling back on the column normally interrupts any stabilizer nose-down movement, but with MCAS operating that control column function was disabled."

And do you really agree with the simplified interpretation like:

https://news.ycombinator.com/item?id=19424761

"two pilots fell out of the sky to their deaths and it simply never occurred to them to try pulling back hard."

I still believe that the way the airplane behaved in these two cases was exactly the opposite of what the pilots have been trained in their flights and in the simulators, and that the behavior was counter intuitive and unexpected to them and that that is the only reason they weren't able to save themselves.

Good UI is not trivially obvious. And it really makes a difference between the life and the death in certain use cases. And thinking about something in the safety of your armchair is very different from "having the plane that is doing exactly what you don't expect and then you die." The plane behaving the very way you haven't been trained in the simulations before.

Finally, I believe that all the issues reported here

https://www.seattletimes.com/business/boeing-aerospace/faile...

contributed to the manifestation that turned out to be deadly:

"The safety analysis:

- Understated the power of the new flight control system, which was designed to swivel the horizontal tail to push the nose of the plane down to avert a stall. When the planes later entered service, MCAS was capable of moving the tail more than four times farther than was stated in the initial safety analysis document.

- Failed to account for how the system could reset itself each time a pilot responded, thereby missing the potential impact of the system repeatedly pushing the airplane’s nose downward.

- Assessed a failure of the system as one level below “catastrophic.” But even that “hazardous” danger level should have precluded activation of the system based on input from a single sensor — and yet that’s how it was designed."

Interestingly and tangentially, the software people particularly like to blame the user. I've worked in many teams wit more people almost automatically dismissing any user input. But the users are, in fact, typically right in a sense that they often have the real world problems that are simply not recognized by the designers/developers assuming infinite knowledge and the infinite time the user has.


Problem is it seems that it is necessary to offload the stabilizer to be able to trim back. That means pushing the yoke probably being already close to the ground.


> Problem is it seems that it is necessary to offload the stabilizer to be able to trim back.

The stabilizer trim motors are very powerful and do not need to be offloaded in order to work.


I've seen different reports about what's in the training. I think the challenge here is to detect that the system is running haywire and then disabling it. It's not a common situation, never trained, and possibly only something the pilot might have read on the way to the airport. Not ideal for a high-stress situation.


On the 737 airplanes, when the stab trim is running a wheel on the side of the center console turns and makes a loud clacking sound. It is designed to be obvious.

You can see a picture of the wheel here:

https://www.quora.com/What-are-the-spinning-wheels-in-an-air...


You have to make the connection though: that clacking noise is probably that new system I read about doing something. Then you have to determine whether that system is the cause of the problem, and whether disabling the system will either fix the issue, or possibly make it worse.


The clacking sound happens whenever the stabilizer trim is in operation, which is frequently, and has been in 737s for decades.

The pilots would be very familiar with the sound and what it represents. The trim wheel also spins when the trim is running, a large and obvious indication (I posted a link to a photo of it).


It's easy to say with the hind sight. When you are flying a plane, which starts to behave abnormally, you have to analyze hundreds of possible causes and try not to kill everyone on board at the same time. There are multiple reports about poor MCAS manuals and lack of training.


In the case of runaway stab trim, this is not correct. Runaway stab trim is trained for, should be obvious, and the corrective action is in the manual and pilots are trained to handle it.


If runaway stab trim caused by MCAS is indeed what's happened it might not have been obvious enough.

It could well be that it is obvious for anyone with the proper training, but then maybe not all airline pilots get the proper training? Or if they have the training but are pushed to hard in the name of cutting costs, and profits?

However, if it indeed was expected to be obvious to all pilots, why even - as I understand it - have the warning on the optional HUD?

Seems like bad safety engineering to have extraneous warnings possibly increasing cognitive load in a a crisis situation.


Yeah, it’s so obvious that pretty much every country in the world agreed to ground that killing machine...


Effectively they are also grounding untrained pilots.


Perhaps there is some inconsistencies between pilot training, work ethics in staying up to date, reaction under extreme stress


I wonder what their management team was thinking.. "We're going to make so much money by not having to retrain pilots for this new plane!"

Reality: Hundreds of people die within months. Boeing is now worth $25 billion less in market cap and the planes are grounded worldwide.


Reality: they were exactly right, because “we” isn’t Boeing, “we” is James McNerney, former CEO of Boeing. Between when the 737 MAX 8 entered production, and he retired as CEO, he was paid $80 million. You think he has to deal with any of these problems with the dead people and the grounded aircraft?


Even more impressive reality:

Less than three years ago Boeing's stock was worth around 130 USD. Friday it was still 370 USD, almost 3 times more than that.

Less than three years ago its market capitalization was around 80 billion. Now (even after the grounding of 737 MAX) it's still around 240 billion. What happened in the last less than three years? At least, the first 737 MAX planes were delivered around two years ago.

Apparently Boeing had (before the crash) a backlog of 5000 orders for 737 MAX planes, worth 490 billion.

On Boeing's own site:

https://www.boeing.com/commercial/market/commercial-market-o...

"Commercial Market Outlook 2018-2037"

"Robust demand is expected the next 20 years as strong economic growth, growing middle classes, increasing consumer spending on services, and evolving airline business models bring more value to passengers and support the long-term outlook. As a result, the industry will require more than 42,000 new airplanes by 2037 with almost 74% in the single-aisle category."

Looking at all that it's even more obvious why there was such a reluctance to ground the 737 MAX in the US.


No, but thousands of friends and family members of those who lost their lives have to deal with that problem.


> Boeing is now worth $25 billion less in market cap

The 737 Max order backlog ( just over 5,000 aircraft ) has a list-price value of about $600 billion. Even if we assume 50% discounts that's still a lot of revenue.


Revenue doesn’t really matter, it’s profit that matters. They can’t discount 50% because they couldn’t even make the planes for that.


Doesn't mean much if the planes will never be allowed to fly again (or without costly retrofitting once they figure out what needs to change).


From the article:

> Lion Air 610 should never have been allowed to get airborne on October 29, a conclusion shared by those familiar with the inquiry. The plane simply wasn’t airworthy.

Get the feeling there will be a large amount of cognitive dissonance on HN once the final report is released.


Decisions like this probably worked out for them a lot in the past, so this one just seemed like another genius money-saving move. Until shit started to hit the fan, that is.


Reality is also that the rest of the world tested and bought the planes. In the hundreds. There is too much media BS about this stuff. If Boeing says its going to take 10 years to fix, what is anyone capable of doing about it?

I can say for example, that tomorrow Airbus is going to get broken up and turned into a mess because of Brexit, and everyone from the President of France to the Airbus leadership can be blamed for it.

Reality is anyone can blame whatever they feel like these days. Anything surrounding blame can be safely ignored. Look for the people talking about the solutions.


.


Are you saying blame is the answer?


Are you saying blame does not play a part in identifying the problem and finding a solution?


Yes. Who you find to blame doesn't fix the problem, does it?

After you find said individuals, someone has to still fix the problem. And in my experience you always need the help or information from said individuals to do so.

CHOOSING to focus on blame, only produces attacks, defensiveness and avoidance from whom ever you are blaming, when they can be contributing to the fix.

Reaching the solutions get pushed further down the road.

Whenever a crisis unfolds you want the people who created it in the room contributing info, thinking about solutions, rather than focusing on how to save their asses and hiding what they did.

Current culture puts too much emphasis on passing judgements and blaming people. What outcomes are being produced speak for themselves when that route is choosen.


> Every airplane development is a series of compromises, but to deliver the 737 Max with its promised fuel efficiency, Boeing had to fit 12 gallons into a 10 gallon jug.

I know this is just impactful writing, but the more I read about the 737 Max, the more I feel that the business decisions behind it are somewhere in between Intel speculative execution and "fly fast and break things."


Unrelated: the attempt to prevent me from selecting segments of text is a massive turn off to returning to this website.


There is a long list of errors and omissions, which contributed to these accidents, but the bottom line seems to be software development malpractice. MCAS system was designed by Boeing and certified by FAA to keep operating with wildly diverging data from two AOA (angle of attack) sensors. Reports indicate that AOA was the only sensor type MCAS was using. There have to be at least 3 AOA sensors to have some level of reliability in case of a single sensor failure. MCAS should turn itself off in case of large difference between two AOA sensors readings. Whoever wrote and certified that code bears at least some level of responsibility.


The system does not necessarily need triple voting. Many aerospace systems are only primary and redundant. There are two highly trained human pilots aboard who can detect and isolate faulty equipment. And my guess is that these high level software requirements originated with an aerospace systems engineer, not a software engineer. Clearly that high level requirement was flawed (especially in a human factors sense), but we need to remember that passenger planes are not designed to be fully autonomous.

It seems only one AOA sensor is currently used by software. The update will change that.

"The company said it will change the MCAS software to give the system input from more than one AOA sensor. It will limit how much MCAS can move the horizontal tail in response to an erroneous AOA signal. And when activated, the system will kick in only for one cycle, rather than multiple times."

https://www.seattletimes.com/business/boeing-aerospace/inves...


< change the MCAS software to give the system input from more than one AOA sensor

That's even worse than I thought. The data from both sensors was being logged. Some reports indicated cases of huge discrepancies (20 degrees) between sensors. It is incomprehensible to me that MCAS ignored the other sensor. The lawyers will have a field day with that and in this case I say: go for it!


What if the system was arranged such that there were 2 MCAS systems and 2 AOA sensors, each redundantly wired in a cross-strapped fashion? Then, in the cockpit there are two switches: MCAS PRI/RED and AOA PRI/RED. You could then tolerate a simultaneous failure of one MCAS and AOA sensor, as well as have a method to bypass and ignore any failing sensor/actuator.

Disclaimer: I've never worked on aircraft software. I've worked on unmanned spacecraft and the scheme I described is very common for fault tolerance.


Agree. Not having 3 sensors is an objectively bad decision.

Why did they keep the system on with diverging data?

It will be nice to know what are the risks when MCAS is off. Maybe x% of pilots used to the old 737 consistently stall the plane on the simulator.


"the complexity of aviation technology was being pushed too hard and at too great a risk to safety, all in the name of economics."

Using automated systems to adjust the flight characteristics has been going on at least since the 707 with its yaw damper, and likely much earlier.

There's nothing fundamentally wrong with the 737MAX. An entirely new airplane would entail more risk. Altering the 737, with known and proven characteristics, is low risk.


« There's nothing fundamentally wrong with the 737MAX »

This would be like Harley Davidson putting a much more powerful engine in an old bike frame, perhaps because they feel threatened by new technology. However the new engine is so powerful it creates wheelies, and potentially fatal accidents as customers were not made aware they'd need to change their bike driving habits.

There is something fundamentally wrong with the 737MAX and how they installed the engines. I'm not an aeronoticaul engineer so I don't know the best solution to minimize the instability. But they certainly should have tried out more configurations, different wing shapes, done more tests etc. Somehow they skipped all that to get more $$


The new engines are not that much more powerful (NG: 120kN, MAX: 130kN max thrus), its that they are physically larger.

The issue (nose up tendencies at high power settings) was an issue with the 737 Next Generation as well, its just more prevalent with the Max.

Also, nose up tendencies at high power settings is a known issue with all jet aircraft that use underslung engines.


Interesting that you mention the 707 since the UK ARB determined it to be wholly unsafe until Boeing was forced to install hydraulic boost for the rudder. Several of the type had already been lost in training accidents due to lack of pilot command on the rudder. The US regulator showed little interest.

> Altering the 737, with known and proven characteristics, is low risk

But that's the problem; altering aerodynamics, adding three tonnes of empty weight, new FBW wing spoilers and a higher thrust line means that the characteristics are no longer proven and you should be testing from scratch again.


The 707 issue you mention is not relevant to this. The yaw damper is, and was put in to correct dutch roll instability. I believe all jet airliners have such a device installed.

Airplane design is constantly changed throughout production. This is normal, and Boeing knows how to do these things. Re-engining, altering wing shapes, doing stretch versions, all are routine. All airplanes have instability issues, and there is no indication that the crash was caused by an unknown aerodynamic instability.


Does anyone remember the Mercedes A-class that flipped over if you took a sharp turn at 40mph-ish? A large part of the fix was putting in ESP, i.e. a software workaround.

https://www.drive.com.au/motor-news/milestones-mercedesbenzs...


How large a part was the ESP, really? Your link says:

"Production was halted for 12 weeks while a crack team modified the chassis.

Then, to be doubly sure, electronic stability control was added."


That’s something that only Mercedes knows.


> Using automated systems to adjust the flight characteristics has been going on at least since the 707 with its yaw damper, and likely much earlier.

That's glossy.

In our trade, we call that adding another layer of abstraction. And eventually it runs into unbearable complexity and tech debt. Then the thing becomes a disaster.

Sure, everyone does this.

But that does not make it less wrong or less bad.


I don't know what your trade is, all I can say is good luck designing an airplane that has no instability issues throughout its flight envelope, without some augmentation here and there.

Pretty much all airplanes have stability issues. Most of the time the pilot is trained to stay away from them, but sometimes they don't and crash it, and then there's a cry to add augmentation to compensate for the nut behind the wheel.


Hmm, we all know for a fact that 737 max duct typed alight control system instead of solving the issue from root.

How is that relevant to instability.

And as a matter of fact, passenger airplanes are usually stable by design. What Boeing does violates this basic design principle in flights.


> passenger airplanes are usually stable by design

Not so. The yaw damper is an example, used to prevent Dutch Roll.

https://en.m.wikipedia.org/wiki/Yaw_damper


So low risk that it killed hundreds of people


I wonder what design choices were considered and rejected. Was there a missed option that would have been better? Numerous possibilities pop in to mind...

The rear landing gear could have been made to extend more, by telescoping or folding.

The rear landing gear could have been attached more outboard, letting it be longer without the wheels colliding in the middle. Perhaps something else would need to move a bit to make room.

The rear landing gear could have been stowed as the B52 bomber stows landing gear, asymmetrically with one going in front of the other. This would let it be taller since it would be able to cross over the midline of the aircraft.

An engine could be flatter if it had two turbines side by side. The cost of engine removal is still low since the aircraft still only has two engines to remove, and the pilot training is the same because there are still only two engines to control. Really, that isn't a quad-jet.

Letting the fan portion of the engine peek up over the wing is an interesting thought.


The primary concern was fuel efficiency, which is proportional to the diameter of turbofan engine. Two smaller engines would be less efficient. The same with turbofan airflow hitting the wing.


Two smaller turbines can have the same frontal area, which is what creates the efficiency. It's total area, not diameter. Well it is the amount of power per unit of frontal area.

Turbofan airflow already hits the support structures for the engine. Everything is a compromise of course. Tossing a bit over the top of the wing could be beneficial, with the impact of the wing being less harmful than the alternatives.


Another great article on this subject: https://www.seattletimes.com/business/boeing-aerospace/faile...

Notable points:

- FAA delegated System Safety Analysis for MCAS and many other certification steps to Boeing engineers (what can go wrong with corporations policing themselves?)

- Political pressures on FAA resulted in signing off on some certification steps before they were completed

- Actual limit of MCAS’s command was not known to FAA, 737 MAX operators and pilots

- MCAS failure was miss-classified as a “hazardous failure” instead of “catastrophic failure”, which would require redesign

- MCAS was not even mentioned in flight manuals


Why was a new single-aisle plane important?


The continued pursuit of increased fuel efficiency. Airbus managed to make their A320neo more fuel efficient than Boeing's 737 and so Boeing were at risk of losing customers to Airbus.

The new, more efficient engines are bigger and hence didn't fit under the wings of the 737. Hence the "hacks" Boeing did to fit them on 737 that required software augmentation to get it to work safely. A newly designed plane taking into account the size of the engines would have been more inherently stable without software augmentation.

Boeing's solution will probably be to improve the software augmentation by fixing the behavior of error detection and correction in the case of sensor troubles (such as adding clear warnings which some airlines have already added as a optional features)


Maybe it's an overstatement, but further improvements on the 737 is beating a dead horse. Maybe even the MAX was a stretch, but if it weren't for this particular issue, it would live a long and happy life. Not that it won't after this fixes. It will probably be the most audited plane in the skies.

It's a great plane that connected the world, surely, but there is no denying that the A320 family is just more modern and still has more potential to be squeezed from it. Starting from the trivial facts that it has a higher ground clearance and the cockpit has more room to improve on instrumentation.


A lot of commercial flights are on single-aisle planes. The 737 is a very old design, with many updates, and a brand new plane designed from the ground up to fit today's market will likely be more significantly more efficient.

It's just that the 737 has been good enough with changes every so often for a long time, so Boeing has done a lot more fully new designs for larger planes; some of which had tremendous gains in efficiency while increasing passenger comfort; the 787 is reported to use about 20% less fuel than the 767.


Interesting the production methodology follows Toyota. I blogged about the need for exactly this as I'm convinced in these kinds of situations there are employees working on these projects who know there are issues, but because of culture or pressure to launch, are never heard: https://www.cultivatelabs.com/posts/the-rise-of-anonymous-to...


This year hasn't been a good one for Boeing at all, besides 737 Max issues, there have been major crashes of the 707 and the 767 this year.


Not to mention that due to delays building the SLS, Boeing (ULA) may risk loosing the EM-1 flight to SpaceX.

I don't know if the SLS designated (and mostly built) for EM-1 can do the EM-2 mission or other missions, as ULA purpose-builds each previous rocket (Deltas and Atlases) specific to each mission.


By "building" do you mean designing or an actual, phisical rocket?


Most of the hardware is already built.


links?



It is nice to see articles out highlighting that Boeing's choice to string the 737 along will come at great cost.


Why is this? I’m not an expert or really follow the airline industry too closely. I’m curious to understand what about Boeing’s decision to continue the 737 line prompts your comment.


They slapped new engines on old airframe to save costs of qualifying new airframe and airlines save costs on retraining crews.


It's a very big picture.

The reason you feel like hell after taking the Redeye isn't that just that you took the Redeye, but you took the Redeye on a 737.

The marketing term "narrow-body" belies that the 737 is wide enough but not tall enough for the human physique. Just thinking about the curve of that circular fuselage makes my neck start to knot up.

Don't believe me? The Embraer 195 is a smaller plane that feels huge on the inside compared to the 737.

More advanced planes like the 787 use electric bleed air to save energy and vent less toxic fumes from the cabin which also makes air travel more pleasant.

The fuselage cross-section dates back to the 1958 Boeing 707.

There is great concern about the environmental impacts of air travel and since 737-class planes (like the Airbus A320) are produced in greater numbers than other aircraft, the flying public, the world, and the airlines deserve something better as an everyday flyer.


How much of this is hindsight? The article seems to suggest that the 737 Max is poorly designed and incorrectly certified. Is the system really that broken? Who knew? Could anyone have known? Are other aircraft similarly flawed?


Imagine how it goes for military aircraft. If a Boeing military jet crashes, there's no NYTimes coverage, no foreign governments pressure, no dramatic images of emergency response team around crash site. Maybe just a single family voice, or one over zealous Pentagon officer asking questions. But if Boeing doesn't even acknowledge risks after a phone call with Trump, I can imagine Boeing always claiming their military jets are the safest aircraft ever.


This is incorrect: I read about military jet crashes in the NYT on a regular basis, and occasionally the military grounds an entire model of aircraft.


Safety isn’t as high a priority for military aircraft, except in that losing an aircraft is expensive. Military pilots know that they are expected to die for the mission if necessary.


Suicide is not part of conventional military doctrine. Pilots are tremendously expensive and take time to train, so they are not expendable. One of the things going badly wrong for Hitler by the time of the Normandy invasion was he was running out of trained pilots. Factories can build ten more planes when you lose ten per night, but your pilot training can't replace ten men overnight regardless of whether those men are dead or in POW camps.

The RAF was losing planes too of course, but mostly in friendly territory, so it kept getting the pilots back. Put them in a new plane and you've kept all that valuable real world experience.


> even acknowledge risks after a phone call with Trump

Here is how I imagine such a call.

"Oh, our planes are safe, Donald. Who's a good boy, Donald? You are! Good Donald!"


    Boeing CEO Dennis Muilenburg reportedly spoke 
    with President Trump earlier Tuesday, 
    urging him not to ground the jet.
Great priorities there, Dennis! /s




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: