Profits 1st, Safety 2nd?

Please continue on this thread, Thanks.

Whenever I read a news about someone blowing a whistle I have two immediate, potentially conflicting, thought chains:
Disgruntled employee;
It really happened.
In this case the second appears quite likely, but that doesn't rule out the former.

---

Bob Smith
Member of Seti PIPPS (Pluto is a Planet Protest Society)
Somewhere in the (un)known Universe?

Good points, but one point in that article is thought provoking. Synthetic Airspeed.
That is on the 787 so "could" it have prevented MCAS from operating on those 737 MAX's?

Whenever I read a news about someone blowing a whistle I have two immediate, potentially conflicting, thought chains:
Disgruntled employee;
It really happened.
In this case the second appears quite likely, but that doesn't rule out the former.

Quite often you can get both.

A conscientious employee gets blown out by a targets driven mindless manager to the detriment of the entire world...

What is any underling of good morals able to do?...


This is where we really do need reliable audit trails and transparency. Peer pressure and openness does wonders to keep everyone 'honest'...

All in our only one world,
Martin

---

See new freedom: Mageia Linux
Take a look for yourself: Linux Format
The Future is what We all make IT (GPLv3)

Unrelated to the 737Max, Boeing have notified the FAA that checks need to be carried out on the 737ng for cracks in the structure of the wings. https://www.foxbusiness.com/technology/boeing-cracked-part-737ng-jets

For a bit of an update on the Boeing 737 MAX catastrophies, this article gives a very good summary of the Boeing 'game' to date:


The Four-Second Catastrophe: How Boeing Doomed the 737 MAX

There's a good run-through of what the pilots fatally had to try to recover from...


Also note:

The 737 Max has 'no value' after 2 deadly crashes as passengers no longer trust the plane, the lawyer for an aviation firm suing Boeing says

... The lawsuit, filed in Chicago on Monday, is claiming fraudulent inducement, breach of contract, and breach of the duty of good faith and fair dealing against Boeing.

It claims that Boeing "manufactured and designed an aircraft that was not safe for flight."...



Note that the plane has been grounded since March... And continues to be grounded. You can bet that the full resources of mighty Boeing are hurriedly being applied to patch up whatever is needed... Does that not suggest some seriously bad 'short cuts' had been made previously?

All in our only one world,
Martin

---

See new freedom: Mageia Linux
Take a look for yourself: Linux Format
The Future is what We all make IT (GPLv3)

What have Boeing decisions to put bigger engines on to the 737 to do with with how people perceive to risks?
The MCAS was installed to help the pilots in case of risk of stalling. But obviously it fails sometimes.
Why didn't they extended the landing gears instead when they revamped the plane is what I like to know.

It's called "Human Factors" - the way people perceive and react to risks, signs and signals. It's all too easy to present a human with more signs and signals, or signs and signals in a bad sequence, and that leads them into making a wrong decision.

As to not increasing the height of the landing gear - space, or rather the lack of it. The 737 was designed as a very low slung aircraft to aid ground loading, which lead to the engines being quite close to the fuselage, the wing box being the shape it is, and a whole lot more things. To increase the landing gear height would probably have meant moving the engines out on the wing, increasing the wing box volume etc, etc, etc. Moving the engines out would almost certainly have had a big impact on the way the aircraft handled, particularity in single engine operation. And that would almost certainly have led to the new aircraft not being "type compatible" with other members of the 737 family, as it would be very difficult to resolve with a "simple" system like MCAS (was meant to be).

---

Bob Smith
Member of Seti PIPPS (Pluto is a Planet Protest Society)
Somewhere in the (un)known Universe?

How MCAS came to be?

Is that somehow trying to excuse Boeing management for their fatally pushing too many cost cutting shortcuts and (in my humble personal view) lying to and misleading the (underfunded and too easily led) FCC?

Safety critical systems are called safety critical for good reason and must always be respected...

All in our only one world...
Martin

---

See new freedom: Mageia Linux
Take a look for yourself: Linux Format
The Future is what We all make IT (GPLv3)

To increase the landing gear height would probably have meant moving the engines out on the wing, increasing the wing box volume etc, etc, etc. Moving the engines out would almost certainly have had a big impact on the way the aircraft handled, particularity in single engine operation. And that would almost certainly have led to the new aircraft not being "type compatible" with other members of the 737 family, as it would be very difficult to resolve with a "simple" system like MCAS (was meant to be).

I'm not an aircraft designer so I cannot really tell if a design is good or bad. What's clear from the news however is that the 737 Max new engines to fit the airframe is a bad design that have to rely on a computer system that hasn't been tested thoroughly enough and the pilots haven't got enough training to test the MCAS misbehaviors. And several pilots didn't even know what the MCAS ment.

To increase the landing gear height would probably have meant moving the engines out on the wing, increasing the wing box volume etc, etc, etc. Moving the engines out would almost certainly have had a big impact on the way the aircraft handled, particularity in single engine operation. And that would almost certainly have led to the new aircraft not being "type compatible" with other members of the 737 family, as it would be very difficult to resolve with a "simple" system like MCAS (was meant to be).

I'm not an aircraft designer so I cannot really tell if a design is good or bad. What's clear from the news however is that the 737 Max new engines to fit the airframe is a bad design that have to rely on a computer system that hasn't been tested thoroughly enough and the pilots haven't got enough training to test the MCAS misbehaviors. And several pilots didn't even know what the MCAS ment.

With those new bigger (and more powerful) engines and their position upset the balance of the airframe (making it nose lite), but that could've been balanced by moving the wings back (though I guess that moving 1 body module from behind the wings to in front of them would warrant recertification).

And what does a re-certification of an airplane cost? Well apparently a lot since Boeing instead tried to do a fix called MCAS.

What everyone here fails to grasp, is some design software engineer missed what was going to happen with the new engines. (Heck maybe as simple as the wrong specs were input) It wasn't until test pilots were up in a real airplane that the nose light condition was identified. Far too late for a design change such as moving the center of gravity a bit more forward by changing where fuel tanks were or moving the wings back a row of seats. Boeing was building air frames when it was found. So software was seen as the only possible fix. A rushed hack job fix at that. Then they flew the first fix version and it wasn't enough, so another hack fix was added on top of the original hack job. That was MCAS. It worked very well on just delivered out of the factory new aircraft. Not one was lost in a ferry flight from Boeing to the airline who bought it. (Want to talk about pilots with zero hours)

The issue is 100% human. It is called throwing good money after bad. When that late nose light issue was discovered, there was a human goof. A halt wasn't called. When that first hack job didn't work another human goof. A halt wasn't called. It is all a failure to cut your losses. Perhaps with the time now they will have been able to write good software with redundant checks to counter the nose light issue. What should have been done in the first place if not actually changing the air frame. Kind of like putting a safety shield on a Pinto gas tank to prevent puncture in a rear end crash.

What pissed me more is the same thing in training pilots. I know there is a massive shortage. Tough. People aren't going to hop an airplane. They are going to have to get on a train, bus or drive. Training a pilot isn't something that can be skimped on. You can't have pilots certified who only learned how by watching others on a simulator. That is just as bad decision as MCAS. It worked once, so it will continue to work.

I find the Airbus solution as a disaster waiting to happen too. Designing the software so no matter what the pilot does with the controls the plane won't stall. Well, what happens when the software goes offline because of say conflicting inputs? Has the pilot ever flown without backup? Can he recognize and approaching stall? Can he recover from one if he has never been able to practice one because the software won't allow it?

Instead of videos of Tesla drivers sleeping at the wheel we are going to see videos of airline pilots asleep at the controls!



Asked is what is costs to certify a design. That is the wrong question. That is a one time cost to Boeing. Peanuts. What is expensive is a new design means every customer has a cost to certify every pilot on the new design. That's killer expensive. Say crew out of service for a week getting paid to fly a movie screen times how many pilots?

Asked is what is costs to certify a design. That is the wrong question. That is a one time cost to Boeing. Peanuts. What is expensive is a new design means every customer has a cost to certify every pilot on the new design. That's killer expensive.

But doesn't a new design need to certify every pilot on the new design? Profits 1st, Safety 2nd?

Gary as ever wants to shift the blame onto someone, or some organization, other than Boeing.

Somebody within Boeing wrote the spec for MCAS (high level).
This would then be checked by at least two others to make sure it complied with the project intent documents.
Another person wrote the software module specification for that particular module.
That would now be checked against the "the spec" for MCAS to make sure it correctly reflected those requirements.
Boeing employed the software engineer (either directly or indirectly).
That software would then be checked against the "house rules" for compliance with coding standards.
And then the source code would be "walked through" to confirm it should comply with the module requirements.
The it would be integrated into the system it lives in, and more checks.

At each stage Boeing were the responsible party - the party responsible for ensuring the work (actual writing and checks/tests) was being done in accordance with both its own procedures and any laid down upon it.

OK, that's "MCAS Mk1".

Someone within Boeing decides MCAS needs bigger muscles, and why bother with that alarm, there are plenty of other alarms that can/will cover it. And back round the cycle we go.

Sitting in parallel with all this there are two other cycles, the "project cost people" and the "project safety people". The former are the people who will have to do two things, track the cost of the job and work out how much this will impact on the finished cost of the aircraft. The latter are checking to make sure that MCAS complies with the safety laws applicable - the latter should be allowed to operate without "undue interference or pressure from their management or other third parties".

And over all that are two bodies - Boeing management and the FAA. The FAA can only interact when they see a major short-fall in either process or product (doing something wrong, or making the wrong thing). Boeing's management are Boeing's management, they have overall control of the budgets and timescales, and are the body of people who are ultimately responsible for the actions of all the product and the staff involved in developing, designing and building the aircraft.

As a footnote - Airbus continue to spend a lot of time and money on their software, possibly a lot more, and better targeted than Boeing appear to have done in recent years.

---

Bob Smith
Member of Seti PIPPS (Pluto is a Planet Protest Society)
Somewhere in the (un)known Universe?

Well Airbus perhaps have been more lucky than Boeing not having to revamp a 737 design from the 60's....
The reasons Airbus hasn't killed Boeing... yet!
Mentour Pilot's dog Molly says "Arf Arf":)
https://www.youtube.com/watch?v=bwVXnYYRXcs

Gary as ever wants to shift the blame onto someone, or some organization, other than Boeing.

Gary wrote:

What everyone here fails to grasp, is some design software engineer missed what was going to happen with the new engines.

Can't read or is it won't read?

Or are you saying Boeing doesn't design it own airplanes?

YES I CAN - you arr totally and utterly WRONG - there are far too many steps AFTER the code has been written for a singe mistake to get out into the wild.

ALSO - MCAS, as initially designed was deemed "too tame" by Boeing, so the specification was changed to increase it from "just one pull" to a whole series of pulls until the end-stop was reached.

I would not expect a software engineer to understand all the ramifications of installing new engines as they are several layers removed from the aerodynamics - they work to SPECIFICATIONS which lay down the required outputs, the number of clock cycles available to do the function (yes - on the ancient chips in use one has to count clock-ticks) and so on. The interfaces between the software teams and the hardware teams are a huge number of specifications, with each software team being responsible for implementing one or more of these.

SO the process is goes like this (again)
Engine engine engineering team "these big engines are too big to go under the wing in the current engine position, please find space for them"
Project team passes this to air-frame team
Air-frame team look at all the possible solutions and come up with "Move them forward and up - can anyone see any problems with that?"
Engine team "No problem, we've now got the space we need"
Aerodynamics team "There might be a small problem - at some attitudes and thrust setting there may be a tendency to for a bigger nose-up attitude than existing so stick forces will be higher, but we won't know fully until we do some more tests"
Project "OK, are there any possible solutions to this problem"
Aerodynamics "Well, there are a couple of aero-tricks, but they may have problems elsewhere in the flight envelope"
Flight-dynamics "If we could have a small amount of nose-down trim in such situations then we should be in the clear"
FCC team "We can build that, but of course it cannot affect flight safety otherwise we will bust our budget"
Project team "OK, we'll make sure it's not a safety function....."
B*t team "We've come up with a name 'Maneuvering Characteristic Augmentation System', there you are, it isn't a safety function as it augments the perceived handling, nothing to do with safety".
FCC team code it, and all are happy - MCAS is not a safety function.
And so MCAS (in its initial design was born)
The safety team looks at the spec and say "Within these limits it is OK, but we've only looked at the current limits of operation".
The testers get hold of the systems (including the code) and do their stuff - code inspections, code analysis, integration analysis and functional testing etc. And MCAS has been implemented as designed.

Then there is that infamous "one small change", it's only a small one to a non-safety sub-system so safety aren't fully in the loop, the project was running late and tight on budget.

And ALL of this is within Boeing's scope of responsibility.

---

Bob Smith
Member of Seti PIPPS (Pluto is a Planet Protest Society)
Somewhere in the (un)known Universe?

https://apnews.com/5ff095b8b9954b03925410680e8c907d

SEATTLE (AP) — Ethiopian Airlines’ former chief engineer says in a whistleblower complaint filed with regulators that the carrier went into the maintenance records on a Boeing 737 Max jet a day after it crashed this year, a breach he contends was part of a pattern of corruption that included fabricating documents, signing off on shoddy repairs and even beating those who got out of line.