At this point, the ramifications of faulty data input from only one sensor into the MCAS system of the 737-MAX are well understood, having allegedly led to 346 deaths, losses of almost 10B USD for Boeing, losses of around another 1B USD for American and Southwest, skepticism about the FAA's oversight ability, and even a potential hit to overall U.S. GDP.

That's pretty bad. Even in today's business culture where many mistakes are whitewashed, explained away or "taken care" of by a few executive firings, it's still reasonable to conclude that had it known what was going to happen, the manufacturer Quality Control would have done anything in its power to identify and correct the issue before the planes first shipped. Indeed, the concept (in hindsight) should have never left the drawing board.

Solutions could be as simple as releasing the software patch they claim is currently under test, through programming not accepting data from only one sensor (not as an option), and better pilot training and education.

It could also be fixed by more organic solutions, such as : adding several more AOA sensors, lengthening the fuselage, repositioning the engines (setting them a bit wider), and/or longer landing gear (see Constellation, Concorde, XB-70).

What would have to be done to the plane's design to make its aerodynamic handling equivalent or better than the 737 NG series (or any other modern airliner), without need of a late-stage corrective system?

  • 4
    $\begingroup$ IMO, MACS, if done right, is a viable solution, and is not less organic than any other options. Augmented control isn't anything new by this time. What's wrong is 1) MACS's lack of redundancy of key componens, especially THE most critical AOA sensor, 2) MACS's dangerous behavior when components fails, 3) general lack of usability and thoughtfulness, being a rushed duct tape solution 4) Boeing's withholding of information from pilots of MACS's behavior and failure modes. $\endgroup$ – user3528438 Dec 20 '19 at 2:23
  • 2
    $\begingroup$ I think, my point is, MAX's tragedy isn't a series of technical mishaps. It's a series of corporate crimes $\endgroup$ – user3528438 Dec 20 '19 at 2:30
  • $\begingroup$ Arguably, 1 and 2 (and partly 3) are "technical mishaps", and even the rest is not necessarily "corporate crime". Lack of proper judgement, yes, and I gues this is the crux of the question: what would be a better judgement. I agree with John's answer on details. $\endgroup$ – Zeus Dec 20 '19 at 4:09
  • 1
    $\begingroup$ @Bianfable why any question regarding MAX is a direct ban on this site. Come on guys, I think we can have a civil discussion here, and learn something. I want to learn it now instead of 10 years later. Please don’t flag the question, unless it’s really required. And it’s hard to find quality answers any where else. I would prefer to put up with some chaff, rather than finding nothing. $\endgroup$ – Kolom Dec 21 '19 at 10:01

The Max's problems had nothing to do with stall. The larger more forward nacelles caused shifts in the aerodynamic neutral point, only discovered during testing, that had an effect similar to shifting the center of gravity aft, and if you were holding a certain amount of stick force, say in a turn, keeping that stick force in would cause to nose to drift up unexpectedly. This happened in certain configurations and speeds. It was as if a whole bunch of passengers suddenly moved aft in a group and you were holding 15 pounds of back pressure and suddenly that back pressure would make the nose rise when you didn't actually change anything you were doing, and you would have to ease off some of the back pressure to compensate.

The behaviour in itself did not prevent the airplane from being certified if pilots were trained to recognize it. But it was enough of a deviation from the other '37s behaviour that it put the common type certification at risk. This results in a very expensive supplemental training burden on Boeing's customers. MCAS was a software bandaid that used the trim system to make the airplane's behaviour mimic other 737s in the particular regimes where this was happening.

Boeing used an even stranger software bandaid on the 787-8, where the FBW system actively runs the normally dormant outboard ailerons to fix a wing vibration problem. In the age of FBW this isn't all that controversial.

Anyway, there was a very fatal defect in the architecture of the system where it took data from only one AOA vane, because whoever did the system safety analysis decided that the failure mode where the system malfuntions due to defective AOA input was a low criticality failure (I think it was only classed as Major, not Hazardous or Catastophic). It was classed as being equivalent to a stab trim runaway and depended on the HSTAB QRH procedure to deal with.

This allowed a mathematical risk justification for taking a signal from only one AOA vane. This helps with system dispatch reliability, because if you have dual inputs and must have both, that's "anti-redundant" from a dispatch reliability perspective (two inputs are half as reliable as one). Changing the system to have only one input doubles your dispatch reliability and if it's considered not that big a deal safety wise, it makes sense to do so. That's the main motivation for doing that single input architecture even though it was only more or less wiring and software differences.

The alternative to MCAS would have been physical redesign, maybe moving the operating CG forward which would have required a larger tail, or some other physical change, maybe something to the nacelles that would spoil the lift they were creating, that would've driven costs up and made the airplane way less saleable, and it would probably have killed the program.

In any case, notwithstanding all the other cockroaches that have scurried out from under the rug as it was lifted in the investigation, if Boeing had taken signals from both AOAs and lived with the need to put up with dispatch delays caused by having dual inputs where both must be present, none of this whole fiasco would have happened and it would be merrily doing its thing. The safety analysis that was used to justify a single AOA input (and the FAA's failure to catch it) is at the root of all of it, in my opinion (having participated in supporting roles in similar crises with another OEM over the years). Too bad really.

  • $\begingroup$ As critical as these AOA sensors are, I would have 5, with a simple program to average the closest 3. Even 2 is not enough. With today's incredibly advanced flying computers, these 20th century engineers also may have reduced to size of the wrong fin. Look at bird evolution. They kept their (variable sweep and area) horizontal stabilizer, and, I recently noticed, may even use their webbed feet to help out! Pitch control of the wing is a requirement that can't be designed away. $\endgroup$ – Robert DiGiovanni Dec 20 '19 at 17:44
  • $\begingroup$ That would be wonderful, but by the time you were done over-redundacizing, the project would get scrapped as too insanely overcomplex and expensive. The real world is a mathematical balancing act between risk/benefit/cost. It seems cold and calculating, but it has to be or none of us would be able to afford a ticket. $\endgroup$ – John K Dec 20 '19 at 18:16
  • $\begingroup$ Would 3 more sensors and a little BASIC be too expensive? $\endgroup$ – Robert DiGiovanni Dec 20 '19 at 18:27
  • $\begingroup$ From what I've read, MCAS was designed to use two AOA sensors and a warning if they disagreed, but later that was changed into an optional upgrade. The very idea that a safety-critical system could be made optional (with no public documentation as to why it's needed) calls into question the entire process. $\endgroup$ – StephenS Dec 20 '19 at 18:50
  • 1
    $\begingroup$ @crasic yes the scope of the MCAS's authority evolved and grew and the original criticality classification was probably acceptable, but it should have been re-analyzed and upgraded from Major to Hazardous at some point. I'm sure there was a robust internal debate over that between "factions" you might say, one representing pure safety concerns and one representing the customers' interests from a maintainablity perspective (I have personal experience with this in the industry). Somebody didn't put their foot down when they should have even if it meant opposing senior management. $\endgroup$ – John K Dec 22 '19 at 1:19

Not the answer you're looking for? Browse other questions tagged or ask your own question.