The airlines can and do switch planes at the last minute, though. And I imagine part of the selling point of the MAX not requiring any recertification is that it meant they should be able to also swap a MAX for a non-MAX 737 like this.
Certainly there have been reports of pilots complaining that they didn't find out they'd be flying a MAX 8 until the last minute, and having to get "trained" on it during their ride to the airport.
Not really, though they are all grounded until this is fixed anyway. I'd expect them to be safe after this if for no other reason than any pilot of this aircraft is going to end up with special training before they fly.
Indeed, they won't be allowed to fly until they are likely safer than the older planes in the air today. There was reason to be concerned when the US was hesitating to ground it, but there is no reason to be concerned now that it has been grounded.
After the first crash, I heard a lot of people predicting it would lead to 100% pilot awareness of the defect and its symptoms. The second crash proved that assumption wasn't true :(
It was largely true in the US and EU. Unfortunately everyone is so happy to crap on Boeing (in some cases deservedly, in some cases not) that they forget the carriers bear a significant share of the blame here, particularly after the first accident. If Ethiopian Air had put the same emphasis on pilot and mechanic training/awareness following the first accident that the US carriers did, the second crash would have likely never happened.
Do you know if Boeing sent new training material for the pilots? If not how would non american pilots get new training ? I assume not by browsing the web. Also consider the fact that a pilot that never pilot a MAX could be asked from nowhere to fly this new plane since it is supposed to be no difference from the regular plane and they were never trained for it and maybe did not expected to fly it.
Yet it is still Boeing's refusal to assure that the requisite information ended up in front of the pilots. The manual must be sold with the plane and it must be accurate, containing enough information to instill in an average pilot an accurate understanding of all safety critical aircraft systems, which MCAS, through Boeing's failure to reclassify during certification, wasn't acknowledged to be.
Boeing doesn't get a pass, and the Ethiopian Air pilot was just as capable if only a bit less informed.
If you cannot safely deploy your product/documentation, then you aren't done. Boeing should have known and recognized that.
The certification process is meant to be proof against a failure like this, which goes to show that there are deeper problems in the organization that need remediation.
If you can choose the airline you know what fleet the plane comes from. If you search on the flight number on e.g Flightradar24 you can see what model they used on the flight for several recent flights.
But in the end I suppose the reality is that even an un-fixed MAX-8 is orders of magnitude safer than your car ride to the airport. So before picking aircraft models, ensure you ride the train to the airport and not a taxi...
I was assuming the person was trying to avoid dying, not trying to avoid plane crashes in particular. Someone who wants to avoid a plane crash but would ride a motorcycle without a helmet to the airport obviously needs to use a different strategy.
You could pick an airline that does not use the plane you don't want to fly. In the US Delta does not fly the 737MAX nor does it have any on order. Delta has ordered 100 of the A321neos in place of the 737MAX.
In terms of project management, aviation software is one industry where the "three-legged stool" should always, always favor quality, so I'm more than happy to see Boeing take the extra time to get this right. Though the nose-pusher system's entire existence is due to the aerodynamic design of the entire MAX...which seems to be driven by the other 2 legs of the stool (i.e. budget and time).
Airplanes are not gliders. There is no reason to not correct aerodynamics via powered systems since that is how virtually any airplane even flies, with the caveat being - as long as it is done well. In other words, I have no problem with the principle of their design choice, just its execution which lacked typical redundancy, and transparency to the industry.
Is there another unstable airliner in operation? Even if it's OK, at the very least flying one (with or without software controls) would seem to me to require a certification by the pilots, which, as I understand, is precisely what Boeing tried to avoid.
There are a number of unstable planes in service that work just fine. I don't see why it matters if they are airliners as long as instability does not translate to a higher safety risk, and I don't know if any other airliners are unstable or how unstable they might be. In this case the instability appears to have been far less significant than the faulty corrective mechanisms. I agree completely that Boeing was not transparent about how to use their plane and did not make it safe enough.
You are very certain of your conclusion while not knowing the answers to all the fundamental questions to make that conclusion.
> I don't see why it matters if they are airliners as long as instability does not translate to a higher safety risk
We don't know what the extra safety issue might be.
> I don't know if any other airliners are unstable or how unstable they might be.
We don't know if anyone has ever done this before, or how completely unusual it might be.
> In this case the instability appears to have been far less significant than the faulty corrective mechanisms.
And finally we don't even know the level of instability. The system was there possibly correcting for huge issues. After all the fleet is grounded instead of just disabling the system.
I've read that the extra lift generated by the nacelles doesn't actually result in aerodynamic instability -- the plane's not going to stall itself -- but results in reduced backpressure on the yoke in a way that fails airworthiness certifications for required amounts of pressure. (With the idea being that the pilots may induce a stall due to not needing to provide as much force on the yoke as they would expect to have to in order to do that.)
> And finally we don't even know the level of instability
It'd approach criminal liability if the FAA certified a plane they didn't know the level of instability of. This is why test flights are performed.
As the other commenter mention, something that gets lost in this discussion is the fact that MCAS was there to make the control feel approximate other airframes.
The same aero adjustments could be accomplished by the pilot, but regulations prohibit their being necessary. So, MCAS.
We're talking 'stability that adheres to control forces required by regulation' rather than 'F-117 drop out of the sky' instability.
Aerodynamically unstable aircraft cannot be flown purely by humans. They require a fly by wire system. The 737 is not fly by wire, thus we can pretty trivially conclude that the 737 is aerodynamically stable.
You keep insisting that we don’t know if this airplane is unstable. My point is that we do know. If you want to argue that some other aspect of it makes it equally dangerous, be my guest. I’m just correcting that one thing.
>You keep insisting that we don’t know if this airplane is unstable.
Because we don't. You've only corrected a strawman, that we know this plane isn't a fully aerodynamic unstable design like an F-16. No one thought that.
I never even specifically said aerodynamically unstable, just that we don't know the level of instability MCAS is correcting for to know if it is unusual for an airliner design. From what I had read I had assumed it was actually a power-on issue and not aerodynamic. But as it turns out the issue is indeed apparently aerodynamic from the engine shape generating more lift at higher angle of attack and thus leading to pitch up.
And no, we don't know. We the public at least. We don't know how big the flight envelope is where MCAS is needed or how much of an issue it would be if MCAS didn't exist. From public information we don't know if without MCAS the plane wouldn't enter an unrecoverable pitch up attitude in normal flying conditions. That's not knowing if the plane isn't inherently unstable.
Just a few comments up, your response to the idea of being totally aerodynamically unstable was “hopefully yes.” Not “of course it’s stable, that’s obvious.” https://news.ycombinator.com/item?id=19556911
I’m not responding to a straw man, I’m responding to what you wrote. If it’s not what you meant, well, I can’t really do anything about that.
Hopefully yes, but we don't know how much instability there is. If you assume the answer there's no point having the discussion.
I was making the point that we don't know what was actually certified. Having F-117 level instability is obviously not the case but apparently the instability it does have is actually aerodynamic so your argument doesn't even work. The actual opposite is happening. The non-fly-by-wire design was modified with an automatic control adjustment to fix an aerodynamic issue. All your argument proves is that the MAX didn't magically turn the 737 into an inherently unstable design which is not relevant to the issue of if the MCAS is covering up a large or small instability.
Ok. “Hopefully” did not convey that to me. It means you leave open the other possibility, not that it’s obviously not the case. In which case I interpreted your statement as saying it could have F-117 level instability. If that’s not what you meant then carry on.
That part of the comment was about the second sentence, that if we just assume everything is fine there's no point in the discussion. F-117 instability would be a ridiculous level though. That we can safely assume. My conjecture from what I've read so far:
- Boeing did a good enough job with the airframe that the plane flies mostly fine but there are no miracles and some specific angle-of-attack and airspeed situations make it fall outside the rules.
- To bring the plane back into compliance they implemented a fairly simplistic solution in MCAS. Because the situation that is being fixed was fairly benign they didn't engineer it with triple redundancies.
- The lack of redundancy was understood to not be a big issue because the worst possible outcome is runaway trim and that's something pilots already train for anyway.
- The MCAS runaway trim presents itself in such a unique way that even experience pilots that are already warned about issues with the plane fail to diagnose it.
It's in this context that I would then like to know how unusual this situation is. If modern airliners all have these kinds of issues solved by control software then this is just another failure mode that needs to be fixed. If instead it was indeed unusual to fix the aerodynamic issue with control systems then the discussion about Boeing forcing through with the 737 instead of redesigning becomes more important.
I made a post upthread about it, but no, this isn't actually unusual, particularly for Boeing. Their design philosophy generally revolves around granting the pilot maximum authority over the plane. There have been various models that have had the same type of compensator built into their controls. The 727-300 I believe is the most notorious I've come across.
McDonnell Douglas also implemented something similar one of their DC' family of jets. I believe it was either the 9, 10, or 11. In that case it was to accommodate a smaller tailplane to decrease drag.
Read mhandley's post upthread. It explains what MCAS does: it addresses a certification requirement for handling control forces at high angles of attack.
"As long as" certainly does not translate to a judgment as to this particular plane's issues. It is a limit as to the type of instability I am fine with - ie safe - or at least not unsafe - instability.
"I don't know" certainly does not translate to we don't know. Plenty of people know.
That is FUD. The level of instability was absolutely known to the manufacturer and certifying agencies before delivery, and even before first flight. The reason why I said "appears to have been far less" is because the summaries of this instability I have read did not describe it as major, and even now, nobody is pointing to the instability as a significant issue. The issue is with how it has been dealt with. Until information comes to light contradicting the information known publicly so far, it is unreasonable for me to be afraid of something I have zero evidence is an issue when evidence to the contrary exists.
We are analyzing accidents that killed hundreds of people and most people are skeptical of Boeing and the FAA for the engineering and certification decisions they took. Saying "I don't know but surely better informed people were ok with this so it's fine" is well below most people's burden of proof. I'm not saying the plane is fatally flawed, I'm saying we don't know the fundamental things to have an opinion on that topic.
Since there is no evidence the problems you are bringing up are actually problems, even after a lot of information has been made public, I think it is more reasonable than not to presume the problem is where most everyone is looking for it. This does not seem to be a great mystery and a fix was already underway before the second accident.
In the strict sense of the term, we the public will never know. The same people who built the plane will provide a fix, the same people who certified the plane will do so again, the same people who were flying them will do so again, and we will trust them or we won't. Some more people will have their eyes on it, but again, we still won't know. That is the way most science and technology works. Everyone has their small domain of expertise and must trust others in their own. Mistakes were made, and most mistakes look stupid/obvious on hindsight, but they don't negate the capacities of the parties involved. All car manufacturers have safety recalls extremely regularly and we don't make them out to be criminals, nor do we make the certifying agencies pariahs. I personally find it an exaggerated response to lose all trust in everyone involved - especially since new models of planes regularly have more accidents in their first few years of flight, because they are hard to make and they have bugs. It also seems unreasonable for me to criticize a manufacturer for taking economic/market concerns into account when historically even the largest manufacturers are on the verge of bankruptcy semi-regularly. Realistically, they must. At the same time this specific decision does not appear to have been the correct one, but I don't demonize them for making it and even at my most cynical, they obviously did not think people would be dying because of it.
I agree with everything you mention here. There just seems to be a disconnect here:
> Since there is no evidence the problems you are bringing up are actually problems
I didn't bring up any problems. I just said that the things you were claiming were true are not things we actually know to be true.
>In the strict sense of the term, we the public will never know. The same people who built the plane will provide a fix, the same people who certified the plane will do so again, the same people who were flying them will do so again, and we will trust them or we won't.
This is precisely true. Which is why I responded to you by describing the bunch of things we don't know. Chances are this will be fully fixed and we will get a very nice detailed report on how that was done. The actual engineering tradeoff of more inherent stability versus more control is something we don't even know enough to conjecture well about. That's what I responded to in your comment.
"Fly-by-wire" is a colloquialism for indirect, software-mediated control of an aircraft's control surfaces, whether to reduce pilot workload in some flight regimes, as with the 737 MAX 8, or to completely manage the aircraft's aerodynamics based on expressions of pilot intent made via cockpit control inputs, as with the last several generations of Airbus aircraft.
Recent 737 models, including the MAX 8, make partial use of fly-by-wire systems, such as the MCAS that's elicited so many hot takes recently. Airbus aircraft, by comparison, make heavy use of fly-by-wire systems, and have for years. In terms of functionality, it's perhaps the single largest difference between their product line and Boeing's.
On the other hand, the widebody 777 is the first Boeing product to go fully fly-by-wire, completely separating the pilots' control inputs from the aircraft's control surfaces in the way that all modern Airbus aircraft do.
If fly-by-wire is the problem - if, as you seem to suspect, these systems exist to compensate for the inherent flaws of aircraft designs which otherwise would not be able to stay safely in the sky - then these Airbus models, and the 777, should have pretty rough safety records, shouldn't they? We should expect to see these other aircraft fail due to problems of the same sort as affected the 737 MAX 8's MCAS, right?
Luckily, we don't actually need to expect anything in this case, because we have good information on the frequency, severity, and causes of airliner accidents more or less all over the world. Indeed, that information is so good, and so available, that it's a major scandal, and a fecund ground for conspiracy theories, in the rare case where it's not available, as with Malaysia Airlines flight 370.
Thanks to that information, we know that the safest airliner on the planet, by flying hours, is the Airbus A340, which has not yet had a fatal accident. Second is the Boeing 777, which has seen only 541 fatalities in its almost quarter century of revenue service - and that's counting the 298 souls aboard MH 17, shot down five years ago over Ukraine.
Both of these aircraft are about 25 years old. Both have full fly-by-wire control systems. And both are, by any measure, among the safest commercial airliners in the world. If fly-by-wire were intended to cover up for the deficiencies in basic aerodynamic design you seem to lump into the term "instability", is this the safety record you'd expect to see?
What do you mean by “inherently unstable” here? We’re talking about an automatic trim system, in the case of the MAX 8; you seem to be reasoning from that to an airframe like that of the F-16 or B-2, that’s effectively unmanageable without its FBW, and I don’t understand how you’re getting there.
If you read my post I was only explaining how the OP didn't actually know the things he was claiming. We just don't know how much inherent instability there is in the airframe that then needs to be fixed by fly-by-wire. It's surely not F-16 level but there is clearly a flight regime where things get hairy. The point is we don't know. The OP was claiming everything was fine on the instability issue without knowing how much there is and how much actually exists in common airliner designs.
Based on my reading of FAR 25, specifically 25.143 - 25.207, I can't agree it's possible for a transport category airplane to be unstable. So I guess I don't know what you mean by "inherent instability".
I also am unconvinced computers can mediate an airplanes aerodynamic design in order to achieve certification under this part, because again by my reading the expectation is that we (pilots and the flying public) can expect static and dynamic stability dynamic stability, laterally and longitudinally. Can computer control improve these behaviors? Sure. Can computer control make them more linear or consistent or docile or predictable? All of those things. But is it acceptable to have negative static stability, naturally occurring by design, in transport category aircraft moderated by computer? I don't think that's allowed but then I'm not deep diving these regulations either. What happens if all computer control goes down? You can't fall back on the natural static and dynamic stability of the airplane, because it doesn't exhibit those characteristics? That seems bad and not consistent with FAR 25.
However, if any such computer safeguards can be disabled (either by the computer itself becoming confused and removing those safeguards; or by pilots disabling them explicitly), I expect the pilot to be trained as part of the type certification requirements, how the airplane behaves when the safeguards are enabled and disabled.
I'm quite sure Boeing knows the answer to these questions. I suspect the FAA knows the answer to these questions. And when you say "we don't know" I think you mean HNer's engaged in discussion, who maybe aren't even aware that quite a lot of things are mandatory for obtaining transport category aircraft airworthiness certification.
> I'm quite sure Boeing knows the answer to these questions. I suspect the FAA knows the answer to these questions. And when you say "we don't know" I think you mean HNer's engaged in discussion, who maybe aren't even aware that quite a lot of things are mandatory for obtaining transport category aircraft airworthiness certification.
I mean that the general public doesn't know that indeed. And thanks for the references, I'll look them up. The original post I replied to was specifically saying that what you are now describing is not allowed (these types of planes being unstable) should be acceptable.
Disabling the system is a possibility, but then they have to train all pilots to fly the plane without that system. Of course there is no training program in place, it would only take a few months to design it, then a few more to get the program certified as enough, then a few more months to teach the trainers how to teach it, then teach the pilots... It is much faster to fix the system once and for all.
All high performance aircraft are, by definition, unstable. An airframe optimized for one flight regime will not be as suitable in another. An airliner like the 737 is optimized for cruise flight (30k feet, almost supersonic) and so isn't ideal during takeoff/landing. Making it good at both isn't an option. So we have systems to modify and adapt the cruise airframe for low-level flying such as this antistall system.
The only really stable commercial aircraft are, perhaps, the bushplanes. They are not fast and not fuel efficient over any real distance.
Well, they do. That's what flaps are. They change the shape of the wing to better optimize for slow flight. Swing-wings work but are hideously heavy/expensive. We will never see an airframe able to morph into constantly ideal shapes like a birds do.
> All high performance aircraft are, by definition, unstable.
This doesn't follow. Not even fighter jets were inherently unstable before modern control electronics. Using the electronics to make the flight characteristics better is not the same as the airframe being inherently unstable.
There were stable at altitude, but at low speeds those "fighter jets" became very twitchy. Delta or swept wings are a problem when low and slow. Their landing speeds were sometimes extreme and/or their angle of attack so high that visibility was an issue.
Fighter jets are also, in comparison to airliners, not very aerodynamically efficient. They can be fast but burn lots of fuel while doing so. They are like a motorcycle compared to a bus.
Few if any non-military aircraft are aerodynamically unstable. No airliner is. Take any airliner, knock out all its control systems, and it will continue to fly.
>> Take any airliner, knock out all its control systems, and it will continue to fly.
Until they hit an AOA that puts the tail in the wind shadow of the wings. Then some will pancake. They can slip sideways into scary turns/dives and will not recover on their own. And they are delicate. It doesn't take too much force to twist them out of shape.
Aerodynamic stability doesn’t mean it’ll automatically recover from a stall. It means that if it’s flying in a steady state and you perturb it, it will tend to return to the original state.
In a deep stall you can’t recover from, it’s because the aircraft’s stability is greater than its control authority, not because it’s unstable.
The 737 Max is not actually unstable without MCAS. The requirement is for increasing angles of attack to require increasing back pressure on the yoke up until the edge of the flight envelope. The lift from the larger nacelles placed further forward is enough to violate this requirement at high angles of attack. It won't take itself to a stall unless you keep pulling, but it doesn't take extra back pressure to get it there either.
Other airliners have had undesirable parts of the flight envelope. The 727 for example has a high T tail, and it's possible to get into a deep stall, which is not recoverable because at very high angles of attack the elevators are in the turbulent air behind the wings. In the UK, the CAA required 727s to be equipped with stick pushers to prevent them ever getting close to this regime. This was due to their experience with a BAC 111 that deep-stalled and crashed in 1963. I don't think the FAA ever required this though.
DC-9;MD-[89]0;B717 have the same T-tail design, the deep stall was address by changes to the wing leading edge, not sure if they also have a stick pusher.
From a quick look at both planes it might be that going into deep stall in the 727 might be easier because the AOA needed is smaller, but that's just my quick guess
(For those who don't know, a Deep Stall happens when the horizontal stabilizer gets in the "air shadow" of the wings, hence you can't get airflow there to move the plane)
> It won't take itself to a stall unless you keep pulling, but it doesn't take extra back pressure to get it there either.
It won't "take itself" but possibly just a very light pull would stall the plane in some situations, and that is the very safety problem which Boeing tried to solve with MCAS, while keeping silent on its existence, because the plane is behaving differently than the one for which the pilots trained. Which is the opposite of how the plane was advertised and sold.
So any time when the MCAS is off the plane behaves differently than the one for which the pilots trained, therefore "just keep it turned off" was also not an option.
And we don't know how "light" is light, it can really be the case that it's even dangerously light.
I'm not trying to excuse Boeing's shoddy implementation of MCAS, nor their hiding its existence from pilots - both of those are inexcusable in my opinion. But my understanding is that when working properly, MCAS would not kick in except with angles of attack that should not be seen in normal flight conditions. It's quite likely that most pilots would never have experienced MACS in operation during their career. Having said that, the full flight envelope should be available to pilots should they need it, without it potentially biting them. Without MCAS, that's not the case with the Max.
Main question for me is, why doesn't it use gyro meters for figuring out a rough approximation of AoA? So it would only kick in if gyro is above a certain boundaryb and the air speed sensor is below threshold. Then double up both the gyros and the air speed sensors, if anything disagrees give errors instead of activating. Even outside of aviation I find it incredible how naive the current design is.
> my understanding is that when working properly, MCAS would not kick in except with angles of attack that should not be seen in normal flight conditions.
Was the need for MCAS really so infrequent ("never during the pilot's career" -- are you aware how seldom it is?) the planes would simply have MCAS completely disabled and fly as we speak. That would be the full content of the Boeing's "software fix.
It's obvious that MCAS has to be kept turned on as soon as no autopilot is activated. (I'd also like to know how non-redundant (i.e. max 2) faulty AoA sensors affect the autopilot, by the way -- having just read that the modern Airbuses have four of combined AoA-speed sensors).
"But it's just because of the regulations" -- don't forget these regulations are there to minimize the number of crashes. And the regulations eventually in this case reduce to as simple as "the pilots have to be trained for the plane if the plane behaves differently." Which they weren't, and the latest Boeing claimed on that topic, after the two crashes was that the "one hour iPad training" will be enough(!?) And we now even know that Boeing was even allowed to do the certification process for themselves instead of FAA doing this.
Actually... Wasn't there a famous case where the pilots managed to save a plane without engines by just gliding to an airport? Would such a thing even work on the MAX design?
Yes, because the problem with the MAX is that the engines provide an off-center-of-gravity thrust. If the engines weren't running, the MAX would glide just like any other 737.
There is also the case of the Gimli Glider [1], and any commercial airliner is certainly capable of "gliding" for at least some time, but I think the GP was adhering more to the actual definition of "glider" [2], which is an aircraft that can fly entirely without power from any engines at all.
All jet airliners with engines under the wings have an "off-center-of-gravity" thrust. They all want to pitch up when thrust is applied. The MAX, with the engines higher and more forward, actually has less of an issue with this. The issue with the MAX is that the large engine nacelles forward of the wing can produce their own aerodynamic lift at high angles of attack. This is what MCAS compensates for.
Why would it not? You still have to be able to fly the thing in case of a dual engine failure.
MCAS has one function: give the MAX 8 flight characteristics that are similar enough to previous versions to not require significant training.
In fact, it's only when the engines are actually working that you'd need this... they're more powerful and further forward, meaning that at high thrust the aircraft will have more of a tendency to pitch up.
Actually, the engines don't need to be on for the problematic behavior to manifest since the extra lift at high AoA is a direct result of the geometry of the wing+nacelle.
You are correct. The parts of the flight envelope where this is a problem are very high (approaching critical) AoA, or in a very tight, highly banked turn. These would not be maneuvers I'd imagine any pilot engaging in without engine power except maybe in the most dire circumstances.
Transport category aircraft have a vast number of aerodynamic behaviors written in regulations, FAR 25. Approach to stall, stall, and stall recovery are described behaviors they must exhibit (FAR 25.201 - 25.207). Longitudinal static stability and dynamic stability are also defined (FAR 25.171 - 25.181). There is no such thing as certifying an aerodynamically unstable transport category aircraft.
An open question I haven't yet been able to determine is to what degree software is an acceptable mediator to compel such behaviors. But I'm very skeptical that it's acceptable at all, let alone by something that can be intentionally disabled with two switches as a troubleshooting/override, and then also not require any difference training for the new behavior that ensues.
Whether MCAS exists strictly for FAR 25 airworthiness, or to avoid a different type rating for the pilot under FAR 61.31 from any other 737, it's questionable how you get around either of those things once it's disabled on purpose as a emergency/troubleshooting technique.
Which is worse upon setting STAB TRIM to cutoff? That the airplane isn't legally airworthy? Or that the pilot isn't legally type rated? Or even possibly both? And was either the case with the previous 737 models? Definitely not.
>Though the nose-pusher system's entire existence is due to the aerodynamic design of the entire MAX...which seems to be driven by the other 2 legs of the stool (i.e. budget and time).
Sorry, but this isn't a credible comment.
Modern engines run bigger slower fans to reduce fuel consumption and noise. Bigger engines don't fit under the wing.
The engine fitment issue has been around since the 737 went from JT8D -> CFM56, hence the punched in the jaw look of most current non MAX 737s.
New generation, bigger engines, same form factor.
Sure they could've redesigned the half of the plane but then it's not really a 737.
> Sure they could've redesigned the half of the plane but then it's not really a 737.
That is exactly the budget and time bit - lots of time and money for Boeing spent designing a new airframe, then the "not really a 737" part means lots more time and money spent by Boeing getting it certified, and lots of time and money for their customers in getting their pilots trained for the new plane.
Isn't that the point? They attempted to save time and money by not designing a new aircraft (as they originally planned) and found a way to mount the new larger engines that necessitated the MCAS system. In addition, the solution they sold did not, by design, utilize both AoA sensors and did not advise pilots if the sensor disagree unless an additional package was purchased. Furthermore, all of this was in effort to sell an aircraft that would not need significant pilot re-training, resulting in pilots not being familiar enough with the failure mode that resulted in many deaths.
'Additionally, former Boeing CFO James Bell said during the company's second quarter 2011 earnings call, the research and development cost to Boeing to re-engine would be 10%-15% of the cost of a new airplane, which was at the time widely estimated by aerospace analysts to be $10-$12 billion'
A factor of 10 cost difference 'if they had only done x' isn't realistic.
Completely agree with your additional point though, the competition was the A320neo and the us vs them economics look better if you don't have to pay pilots to sit in a simulator and re cert.
Does anyone here know how updates like this are delivered? Sadly the article doesn't answer this question. I suppose it's not as simple as downloading it over 4G or something like that.
Or does Boeing sell MAXes without that screen altogether? The Boeing update page (https://www.boeing.com/commercial/737max/737-max-software-up...) says it is the "baseline primary flight display" , so sounds like it would be included in all MAXes already, so no physical change may be necessary.
So from what I’ve read (happy to be corrected) the very odd thing here is apparently all of the 737 MAXs do always have two sensors installed. This was purely a software difference as to whether the AoA disagree option was software enable. This feature cost more money but it seems it exists entirely in software. The indicator is even just drawn on the LCD displays, it’s not a special light on a panel.
This blows my mind and reeks like other product management decisions I’ve faced in my particular industry where someone said “make that a feature we can enable so we can charge for it”. And they did charge more for it. Now everyone will get it free.
Not sure it should be that simple either. You would probably want someone with physical access to the aircraft to deliver upgrades in order to avoid someone tampering with it.
A few years ago, we had to wait one and a half hour before takeoff in a 787. After that time they said "Sorry, the we needed a bit more time for the software update on the plane" over the speaker ...
I think not just mapping information, the 787 had some really really bad bugs when he was new, like shutdown the whole plane (even in the middle of a flight) if you didn't reboot for a month and such.
Yes. I deliver such software. The downloading can be done over a network, however there should always be another mechanism in place to ensure only an authorized version runs.
For example the vital computer compares a coded key compiled in the executable code with one read from a physical dongle. If it does not match, the system refuses to start. The dongle must be replaced separately by the person installing the software.
It’s just an example. There are plenty of variants possible.
There are usually also check lists, where the running version is displayed and verified on a safety related display to confirm the upgrade succeeded.
Ah and yes of course the software is checksumed and you must verify the sum to make sure you load what has been certified and not some random piece of $£%# pretending to be it.
Man oh man. Having (loosely) followed this saga, it sounds horrifically similar to every other "feature rush" I've ever seen in software development. I know this a fiction, but I can just imagine the scene - boss comes into SWE meeting, says "some other team implemented this thing that the higher-ups wanted, we have to change all of our stuff to make it work, and we only have X weeks/months" (common sin: deadlines before effort estimates). Then more issues are discovered in dev, SWE's try to push back but are ignored (common sin: concerns are not heard). "Scope is reduced" (common sin: this ALWAYS happens with hard deadlines, but SHOULD NEVER happen with human safety involvement, although it still does all the time e.g. healthcare).
It's not until some poor, senior engineer, who is probably one of their best staff, has a stellar reputation, and genuinely cares about their job, their team, the product, and the company ... they have to fall on the sword and TELL management what's going happen: we're not shipping this yet, IT IS NOT SAFE. Then that goes all the way up the chain, management at every level wrings their hands, "how oh how did this happen?" (although they specifically are talking about the missed deadline, not the safety concerns). It gets high enough that feeling is overcome by senior leadership wrath, which flows back down, and ultimately that engineer and their entire team is punished.
If you know what's going on, MCAS is quite safe - there are two highly visible switches that kill electric trim completely (thus disengaging MCAS) and allow the pilots to take manual control. Activating these switches is a memory item (i.e. pilots have to memorize the checklist) for runaway trim and would be universal across 737 variants.
Unfortunately, it appears that both the Lion Air pilots and the Ethiopian Airlines pilots did not recognize that this was a runaway trim issue at all (or until it was too late). If the Ethiopian Airlines disaster turns out to have an identical cause to the Lion Air crash, one has to question why the pilots did not take this simple corrective action.
Because Boeing refused to provide them additional training that was needed to make these decisions. Boeing wanted to sell it as an add-on package. And the basic mandatory training they provided was on an iPad instead of simulator.
Boeing did not want to sell the training as an add on package, they didn’t want more training at all. This reduces the cost to purchase the 737 Max, because existing 737 pilots can fly the max without recertification.
What was sold as an add on was the system to detect the two AoA indicators disagreeing. This would help, but it probably would have been less effective than MCAS training would have been.
Better still would have MCAS read both sensors and disengage when they disagree, with an alarm.
MACS is safe but its not zero delta training as Boeing advertised. Pilots who were trained on it properly are able to recognize the problem and fix it when it occurs.
I think you'd be surprised how often small problems can occur on planes. They all have _potentially_ huge severity, but none of them have huge consequences because they are expected problems that pilots are trained to respond to.
I disagree; modern nuclear power is way safer, and is a result of decades of continuous improvement.
MCAS on the other hand is basically a bad hack that was necessary for business reasons. It's a serious step backwards in safety from previous iterations, which has not happened with modern nukes.
I'd say MCAS is a predictable business hack that resulted from terrible regulatory pressure.
Airplane certification is expensive for both manufacturer and airlines that might want to fly it. So there is a quicker process if you just make minor revisions, a reasonable compromise on the surface. Certification is so expensive and not having to retrain pilots is such a huge selling feature it creates a pressure to make planes that meet the same type requirements rather than design new airframes.
Boeing is all set to design a new airframe to replace the 737 that will be more fuel efficient and be built for today's point to point flights. Along comes airbus with the a320neo (new engine option) that kills the 737-800 on fuel efficiency and Boeing panics. They scrap 2020 plans for a 737 replacement and design the MAX. Now the problems mount. Fuel efficiency needs turbines that spin slower but have more surface area and are therefore larger. 737 is a low slung plane, dating back to hub and spoke flight concepts where the 737 might land places that don't have jetways. Since the plane is so close to the ground, Boeing has to move the engines forward so they can raise them. This generates more lift than previous 737s, but to meet same type requirements the plan has to be the same. Not meeting same type means they can't sell to airlines like southwest who only fly a single type and any airlines who do commit will have to spend training dollars, raising the total cost of operation without adding anything to the bill of materials.
Enter MCAS, a system designed to meet the same type regulation with disastrous unintended side effects. Side effects made much worse by the fact pilots don't know the system even exists since this plane is the same as every other 737 as far as they know.
I don't think the same type regulation should be scrapped since it would stop things like fuel efficiency gains during an airframe's lifespan, but there needs to be a same type minimum training and documentation that has to be done even if the only thing you change is thickness of the paint. If anything the definition of what meets same type should be slightly expanded allowing more flexibility in what can be changed. Combined with mandatory training for all subtypes (but still much shorter than different type training) the perverse incentive to make the plane behave exactly the same is removed. That leaves room for the better technical fix to win the day rather than the one that will meet the regulation. Training costs will go up some, but less than full different type certification.
Boeing didn't panic at the NEO, their biggest customer(s) like Southwest wanted something ASAP that was competitive with the NEO. Airlines like EasyJet, Ryanair, and Southwest built their entire business on flying exactly one type. EasyJet with the A320 family and Ryanair + Southwest with 737. Southwest flies around 700 737s currently and retired their 737 Classics when it became clear that the FAA wouldn't sign off on pilots being rated on the Classic + NG + MAX at the same time (instead it Classic/NG or NG/MAX). You can build a profitable airline on a diverse fleet (look at Delta, they fly almost anything imaginable), but that's not where Southwest is now and it's an expensive road to diversify.
There's a nasty rumor that Boeing agreed to pay Southwest $1 million per plane if additional training was required. That's a lot of money just on the Southwest contract. If any other airlines (e.g. Ryanair) demanded similar that's a huge chunk of money.
Those regulations are written in blood. Thousands of airline passengers died to get those regulations where they are today, and lessening them would likely cause more deaths.
I see this entirely differently -- the FAA was being way too lenient/cozy with Boeing, and took their word that the airplane operated exactly the same (even if it didn't). This to me indicates that harsher regulations are needed, not less harsh ones! In what other industry do manufacturers self-certify such safety-critical machines?!
Relax regulations and we'll just start seeing more of those crashes that have killed so many airline passengers previously. It's a proven fact across all industries since time immemorial; companies don't make things safe out of the good of their hearts, and are OK with shockingly high body counts. Governments have routinely needed to rein in companies that were playing fast and loose with safety.
Saying that something requires training to be operated safely does not mean that it is unsafe. It means that it's a complex system that requires training to operate.
Place a random passenger into the cockpit of a modern commercial airliner without training and ask them to fly the thing safely and you'd probably have a 100% loss rate.
> Saying that something requires training to be operated safely does not mean that it is unsafe.
This ultimately is not a training issue. Why was a system that can potentially plow the aircraft's nose into the ground utilizing only a single sensor without any redundancy in place? Boeing screwed up. Now both sensors will be used. Great, but sometimes 2 sensors fail. If pilots that operate these aircrafts are trusted with the lives of 150+ passengers, they should have an "easy button" to take complete manual control of the aircraft. My human sensors should trump any mechanical sensor(s) when my life is on the line.
But can the determination to perform the stab trim cut-off be done in seconds?
Are there other feedback mechanisms present that can interrupt that determination?
That appears to be the case in these scenarios. The MCAS doesn't perform the incorrect action continuously, it looks like initial corrective measures fix the problem until they suddenly don't.
> Activating those switches cuts off electric trim and would completely deactivate MCAS. It can be done in seconds.
That's great...if they'd understood that the system was malfunctioning...but they had no such indication because their airline didn't pay for the optional "feature."
Activating those switches cuts off electric trim and would completely deactivate MCAS. It can be done in seconds.
And then what? How much longer will it take to manually move the stabilizer to a suitable position? How much time do the pilots have at under 7,000 ft AGL? Will the elevator have to be moved nose down to unload the stab before the stab can be retrimmed?
Of course it is unsafe. If it is activated, correctly or not, it operates covertly without indication or anunciation.
It retains no memory of being overridden by pilot input but will keep pitching down until cut-out of the loop or the aircraft exits what it thinks is the dangerous corner of the envelope. Unfortunately it often lacks the information to make that determination correctly, due to the poorly-designed sensor integration.
That sounds like something right out of the 'Catastrophic Failures' books we studied in uni.
> one has to question why the pilots did not take this simple corrective action.
If that was the only issue, the plane would have not been grounded.
But it seems here on HN there's this persistent idea that it's just fine for the plane to start misbehaving and it's "only" a matter of the pilots fixing it.
Sure, why not, let's all run a cronjob that gets a random number, then beeps and wipes your computer every 1/100 times. But hey, it will beep and you'll have 1 second to fix it, sounds good, right?
That is nominally the purpose of a pilot. To safely operate the machine within the envelope for which it is engineered.
There is always a trade-off with these types of decisions, and like it or not, every airframe certified airworthy has the potential to kill everyone on board without proper piloting.
I'm not saying that I'm letting Boeing off the hook personally, but as someone who has an avid interest in engineering things, I do understand the optimization points they were going for with the MAX, they found a physical design that could accommodate those optimizations, but they skimped or didn't put enough emphasis on communicating changes to pilots.
The pilots are the single most versatile safety system on the plane. Hiding or keeping from them the information they would need to form a checklist to handle this type of failure is the major failing here (given we assume there were no other physical configurations that could have been grandfathered in that wouldn't have involved an MCAS like system for certification). The root cause of that omission though may be traced to the minimal retraining requirement, which was absurd in the first place.
Wrong, the flight preceeding the Lion Air crash had the same issue, and the pilots managed it, by switching off the stab trim system as per the runaway trim checklist.
You'll note I said 'aircraft' versus 'flight'. That particular aircraft is no longer in service because it was destroyed in a catastrophic crash caused directly by the faulty MCAS system.
At first, everyone asserted it was 'faulty sensor reading,' but later it came out that there's also faulty programming and the MCAS system has way more authority than originally specified to the FAA.
There’s about 40 seconds before the aircraft becomes unrecoverable in these 2 crash scenarios. It’s not pilot error.
It’s design, software, certification subterfuge, lax FAA regulatory posture, and limited pilot awareness and superficial training. Roughly in that order.
Add to that desperation, in that Boeing was keen to catch up with the Airbus 320neo, and didn’t want to build (and certify) an entirely new aircraft.
Plus an extra sensor and related systems most US 737MAX’s have was an option, and at least the Lion Air aircraft didn’t have it.
Demonizing pilots or belittling the training of the LionAir and Ethiopian Air pilots is offensive and not supported by the facts.
This is going to get worse for Boeing. Their only saving grace is that the airlines and military need them too much.
Why are you so quick to blame the pilots and no one else?
When hundreds of lives are at stake, defense in depth is critically important. Planes that crash unless the pilot does the exact right thing in some rarely occurring situation are not safe. It's bad design. That's like saying that airbags aren't necessary in cars because if everyone just drove perfectly there'd be no accidents. Well guess what, no one's perfect, and building systems that require human perfection are bad engineering.
I'm not blaming no one else. The MCAS implementation was clearly flawed, being vulnerable to a single point of failure in the AoA data (and by the way, that's where the real problem lies. Why is the MAX AoA system failing more than the prior generation of 737 where it's normally totally reliable?)
But here's the thing. It's impossible to train or have a checklist for every eventuality or combination of failures. In the end, it's up to the pilots to use good airmanship and fly the plane. If systems are interfering with that, disable them and fly the plane. Trim system doing something you don't want? Disable it and fly the plane. Instruments disagree? Set known good pitch and power and fly the plane. It was daylight in good weather. Look out the window. Fly the plane. Diagnostics can wait until the plane is flying again.
Those two aircraft were flyable. All they needed to do was flip a switch. And fly the plane.
I'm not in any way suggesting that the problems with MCAS or AoA data on the 737 MAX should not be fixed.
> The MCAS implementation was clearly flawed, being vulnerable to a single point of failure in the AoA data
I personally find the AoA sensors failure to be unlikely in the case of the Lion Air crash as they were replaced in between the two problematic flights.
I most interested in seeing the final results of the Ethiopian crash. My suspicion is the MCAS has terrible software and is a bug-ridden mess.
Ah, but the flight computer switches which AoA sensor it talks to every time it's booted.
If maintenance procedures for testing did not correctly specify that a retest must start, then restart the system to actually test that the repair was successful, then that replacement may have been tested while the computer was being fed data by the correctly operating sensor. They would have had to attempted a single boot between flights for the next flight to have flown with the untested replacement sensor. If they didn't test at all, then it's possible both sensors had a problem.
This is of course assuming that there is any retest procedure at all in the documentation given that the AoA sensor wasn't classified as safety-critical.
It really seems like the makings of a bad movie doesn't it?
> Wrong, the flight preceeding the Lion Air crash had the same issue, and the pilots managed it, by switching off the stab trim system as per the runaway trim checklist.
Which, notably, they did not run right away. The need to run the runaway trim checklist was pure guesswork on the pilot in the jumpseat's part. It took them several minutes of fighting with the controls before they finally killed the trim. They even re-enabled the auto trim after killing it, not initially recognizing that that was what had fixed the issue.
Not even the flight that survived correctly identified the issue initially. This really isn't a case of "see, these other pilots got it right". They got lucky.
While the same checklist fixes both runaway trim and faulty MCAS, pilots haven't been trained to recognize MCAS problems.
The two problems present themselves differently enough that it's confusing pilots (runaway trim is continuous trim movement. MCAS is 5 seconds on, 10 second off).
This is a systematic training issue. Pilots have been trained to recognize runaway trim but not faulty MCAS.
The only real solution is extensive simulator training until pilots reliably diagnose MCAS activations and start the correct checklist, something which Boeing and airlines don't want to pay for.
> If you know what's going on, MCAS is quite safe - there are two highly visible switches that kill electric trim completely (thus disengaging MCAS) and allow the pilots to take manual control. Activating these switches is a memory item (i.e. pilots have to memorize the checklist) for runaway trim and would be universal across 737 variants.
> Unfortunately, it appears that both the Lion Air pilots and the Ethiopian Airlines pilots did not recognize that this was a runaway trim issue at all (or until it was too late). If the Ethiopian Airlines disaster turns out to have an identical cause to the Lion Air crash, one has to question why the pilots did not take this simple corrective action.
Not quite:
While the runaway trim checklist is a memory item, the symptoms that pilots train on in simulator presents runaway trim as a continuous event (the "classic" runaway trim being a relay becomes stuck and the trim just extends continuously).
So while they've trained on the correct response to save the plane, they've never actually been exposed to the symptoms that an "MCAS runaway" presents (stick shaker on the AOA too steep side when the plane is patently not in stall combined with speed warnings and an uncommanded nose-down that goes away for several seconds when the stick is pulled back).
The "backs off" part is critical when combined with the speed warning alerts and lack of continuous trim, because this makes the nose down easy to interpret as coming from the 737's speed trim system, which has existed for decades, and the net result is that the combination of symptoms seems to overload/confuse the pilots.
We have, now, at least 3 documented examples of "MCAS runaway" -- the two downed flights, and the prior Lion Air flight in which a deadheading pilot in the jump seat did suggest to cut the automatic trim, but ONLY AFTER several minutes of confusion in the cockpit. And even after disabling it, they re-enabled the auto trim initially and only re-cut it out when symptoms re-occured.
Which all boils down to: The MCAS system is in no way "quite safe". Safety is not a single line of defence, and the fact that at least 3 sets of pilots have struggled to identify the correct response to the MCAS issue indicates that the design of the system is flawed, because no system is safe when its sole and only fallback relies on humans 100% providing the correct response to a never-before-seen set of symptoms.
I understand, that's why I mentioned that the pilots didn't recognize that it was a runaway trim issue.
After the Lion Air crash, however, this information was widely disseminated by the manufacturer. If the Ethiopian Airlines pilots were not properly trained on this new scenario then there was clearly a breakdown somewhere in the chain of communication.
There is some cognitive limit of how many variants of procedures pilots can be expected to memorise and execute.
Detecting a classic constant runaway trim is an old drill for pilots.
Detecting a trim that gradually runs away, then stops to make the situation look normal, then runs away again until the plane is way off level flight is a new failure pattern.
It works for non-critical software where users can learn workarounds for only those problems they happen to encounter. But it doesn't, in the long run, work for cases like aviation where there is a known but growing set of special conditions that the pilots need to learn and remember even if they don't ever bump into them.
Some comments based on my understanding of the situation. I'm an engineer and I'm interested in the study of engineering failures. So, I have been following this. Initially I was thinking the blame was being unfairly placed on the MCAS system. However, now I understand more, I suspect it is a serious safety problem.
The reason is as you say, MCAS runaway (e.g. due to a failed AoA sensor) does not behave like a normal runaway trim (e.g. continuous trim movement). That is key. Watching Youtube videos was helpful in understanding what the pilot experiences. I initially thought the pilot should easily notice the trim moving because of the large trim wheel beside them. However, in normal takeoff, the trim is being adjusted automatically and so pilots learn to ignore it changing. Second, I think with the 737 MAX, the sound made by the trim wheel has been changed (removed)?
Using the stab trim cutout switches is a drastic measure (occurs as nearly last item on memory checklist) and, as I understand it, the only way to stop a misbehaving MCAS from doing its bad work. If the pilots are even a little slow in figuring out what's happening, I can easily imagine that leading to disaster. Also, if they to realize the problem and flick the switches off, manually cranking the trim wheel the other way takes time and it takes some serious physical strength to do it. I can imagine that if the MCAS moves the trim fully the wrong way, the pilots might not be able to fix it quickly enough.
> The reason is as you say, MCAS runaway (e.g. due to a failed AoA sensor) does not behave like a normal runaway trim (e.g. continuous trim movement). That is key. Watching Youtube videos was helpful in understanding what the pilot experiences. I initially thought the pilot should easily notice the trim moving because of the large trim wheel beside them. However, in normal takeoff, the trim is being adjusted automatically and so pilots learn to ignore it changing.
Yeah, that's the 737's Speed Trim system. Even before the MCAS, automatic trim adjustments to adjust for the '37s behaviour at different speeds were a constant thing in the cockpit. It seems like one possibility here is that pilots may be mistaking or unable to distinguish (since there's no real differentiation) the MCAS' trim adjustments from normal Speed Trim adjustments -- and keep in mind a speed warning is going off the entire time they're fighting the MCAS, due to the malfunctioning AOA, so they may be primed to think "Speed Warning + Automated Trim periodically occurring == Speed Trim" and over-focus on the stall & speed warnings and ignore the trim component.
> Also, if they to realize the problem and flick the switches off, manually cranking the trim wheel the other way takes time and it takes some serious physical strength to do it. I can imagine that if the MCAS moves the trim fully the wrong way, the pilots might not be able to fix it quickly enough.
It's actually worse than that. If the AOA sensor is misbehaving, then it will never show a recovery after the MCAS applies an automatic trim adjustment, leading to the MCAS continuing to apply trim adjustments until the trim is at maximum.
At this point, the aircraft is basically in a nose dive, and if they hit the trim cutout, it can be physically impossible to manually trim the aircraft
> The standard response to just hit the stabilizer cutout switches and manually trim is actually flawed. If the nose has been pushed down by significant mistrim (nose down stabilizer, nose up elevator), and as airspeed increases, it may not be possible to trim the stabilizer manually nose up without letting the elevator go to a neutral position. The reality, under the MCAS runaway scenario, trimming nose up immediately stops MCAS as well as trims the stabilizer back towards an in-trim position. At that point, you would be best off to cutout the stabilizer.
> Many flight crews may not know that you have to relax the elevator to manually trim the stabilizer if the loads is too high.
It also mentions that the techniques needed to relieve the forces enough to make trimming manually possible are not necessarily covered in Boeing's current manuals -- because they completely ignored the possibility of the MCAS trimming to max downwards.
We are issuing this AD because we evaluated all the relevant information and determined the unsafe condition described previously
And what it describes previously is MCAS when receiving erroneous AOA sensor input.
Also, your post basically says MCAS is safe when disabled, because in the very same sentence you claim it's safe you also claim the pilots are supposed to know how to (indirectly) disable it. That's almost comedy.
>why the pilots did not take this simple corrective action
It's a valid question why they didn't take corrective action; it's insulting and asinine editorializing to call it simple.
Looking at one component and saying it’s safe (qualified with ‘if you know what’s going on’) misses the point. In fact it’s an engineering style response because it shows some myopia.
Safety in an aircraft means getting passengers to their destination without injury or loss of life. Boeing failed here - blame lack of training, single sensor dependence or software if you like but there was certainly a failure.
Now no one really cares if MCAS is problematic - any solution needs to resolve the underlying fault.
The underlying fault unfortunately isn't 100% a Boeing problem. There are airworthyness regulations that specify how a passenger plane is to behave near stall that have had a precedent set where non-compliance can be remedied through flight envelope driven interlocks. (See stick-pushers and other piloting aids). Engineeringwise, the airframe was still not compliant; the airframe would still manifest aberrant behavior, but the action on the controls combined with a type certified pilot was considered enough to mitigate the problematic aerodynamics.
This practice, fortunately or unfortunately depending on who you ask, effectively normalized deviance, and short-circuited the protection offered by that airworthyness regulation. It went from being clearly spelled out to "or equivalent level of safety" which opens the door to all sorts of workarounds.
The alpha vanes need to be a high-priority maintenance item. They may also need to be redesigned/augmented such that they can be hardened against typical failure states, or subjected to in-flight remediation/diagnostics and graceful failover.
That isn't easy from my understanding. Doing something like hardening vs. freezing would require some form of heating element, which would potentially effect the calibration of the sensor while active, and increase maintenance complexity. Adding some sort of self contained calibration unit to the sensor could work too, however, the more complexity built into that, the more costly it becomes.
There is a point of diminishing returns, and I do think the plane can be rendered safe with MCAS and pilot retraining.
Unfortunately, that will still come bundled with an aircraft losing its airworthyness rating on Stab Trim cutout.
No, it's not, and most of the regulatory agencies around the world agree. Pilots that Boeing handpicked to test out MCAS fixes (and thus knew what it was, what to do, and expected a problem) agree. And that whole runaway stab trim checklist is a red herring especially after Boeing has come out and said MCAS is a part of STS — itself a system that trims the stabilizer in a counterintuitive manner on the NG. The stabilizer operates in a counterintuitive manner on the NG and MCAS runaway doesn't meet Boeing's definition of runaway trim. Full. Stop.
Those involved in the testing hadn’t fully understood just how powerful the system was until they flew the plane on a 737 Max simulator, according to the two people.
They had 40 seconds to avert the accident from what I read. the memory items for runaway trim take about 1 minute in a relatively calm simulator with a professional 37 pilot to get to that point where they flip the switch[0]. They still had an incorrectly trimmed aircraft when they got to that point. also of note was that the pilots in the sim were at 3000' AGL where the other ones that crashed were at about 1000' AGL.
To be frank, they shouldved went faster then. Emergency situation is no time to fool around. One of them was praying. Imagine if both people were trying at the same time. They could have finished two steps at a time.
Well, to be frank back, the steps are sequential not parallel. I haven't read anything about the CVR but if they were praying instead of flying that's a huge mistake. They didn't have much time though and they didn't have much altitude to work with(in fact, I just looked it up and they were 450' AGL when they started having some troubles but I couldn't find anything on the cvr transcript). the old adage of aviate, navigate, communicate in that order applies.
I don't think the air-frame for the 737 MAX is broken, though.
I definitely agree that the MCAS system should have required two AOA sensors, and been automatically disabled when there was a disagree. I agree that Boeing should have briefed airlines and pilots about the MCAS system, the AOA disagree indicator, and potentially required new training.
Computer controlled instability in a military aircraft is one thing, but instability in a civilian aircraft another thing entirely.
Someone here said built-in instability was an accepted design feature in modern civilian aircraft. I do not remember being asked. I wonder why? John, PPL(IR), passenger.
169 comments
[ 5.1 ms ] story [ 210 ms ] threadI'd be more concerned about flying particular airlines than the aircraft model.
Certainly there have been reports of pilots complaining that they didn't find out they'd be flying a MAX 8 until the last minute, and having to get "trained" on it during their ride to the airport.
Boeing doesn't get a pass, and the Ethiopian Air pilot was just as capable if only a bit less informed.
If you cannot safely deploy your product/documentation, then you aren't done. Boeing should have known and recognized that.
The certification process is meant to be proof against a failure like this, which goes to show that there are deeper problems in the organization that need remediation.
But in the end I suppose the reality is that even an un-fixed MAX-8 is orders of magnitude safer than your car ride to the airport. So before picking aircraft models, ensure you ride the train to the airport and not a taxi...
Of the 346 people that died in the last two plane crashes, not a single one of them died in a car on the way to the airport.
https://airwaysmag.com/airlines/delta-orders-100-airbus-a321...
> I don't see why it matters if they are airliners as long as instability does not translate to a higher safety risk
We don't know what the extra safety issue might be.
> I don't know if any other airliners are unstable or how unstable they might be.
We don't know if anyone has ever done this before, or how completely unusual it might be.
> In this case the instability appears to have been far less significant than the faulty corrective mechanisms.
And finally we don't even know the level of instability. The system was there possibly correcting for huge issues. After all the fleet is grounded instead of just disabling the system.
It'd approach criminal liability if the FAA certified a plane they didn't know the level of instability of. This is why test flights are performed.
As the other commenter mention, something that gets lost in this discussion is the fact that MCAS was there to make the control feel approximate other airframes.
The same aero adjustments could be accomplished by the pilot, but regulations prohibit their being necessary. So, MCAS.
We're talking 'stability that adheres to control forces required by regulation' rather than 'F-117 drop out of the sky' instability.
The question isn't if they didn't know, it's if this is an unusual level of instability for an airliner.
>We're talking 'stability that adheres to control forces required by regulation' rather than 'F-117 drop out of the sky' instability.
Hopefully yes, but we don't know how much instability there is. If you assume the answer there's no point having the discussion.
Because we don't. You've only corrected a strawman, that we know this plane isn't a fully aerodynamic unstable design like an F-16. No one thought that.
I never even specifically said aerodynamically unstable, just that we don't know the level of instability MCAS is correcting for to know if it is unusual for an airliner design. From what I had read I had assumed it was actually a power-on issue and not aerodynamic. But as it turns out the issue is indeed apparently aerodynamic from the engine shape generating more lift at higher angle of attack and thus leading to pitch up.
And no, we don't know. We the public at least. We don't know how big the flight envelope is where MCAS is needed or how much of an issue it would be if MCAS didn't exist. From public information we don't know if without MCAS the plane wouldn't enter an unrecoverable pitch up attitude in normal flying conditions. That's not knowing if the plane isn't inherently unstable.
I’m not responding to a straw man, I’m responding to what you wrote. If it’s not what you meant, well, I can’t really do anything about that.
Hopefully yes, but we don't know how much instability there is. If you assume the answer there's no point having the discussion.
I was making the point that we don't know what was actually certified. Having F-117 level instability is obviously not the case but apparently the instability it does have is actually aerodynamic so your argument doesn't even work. The actual opposite is happening. The non-fly-by-wire design was modified with an automatic control adjustment to fix an aerodynamic issue. All your argument proves is that the MAX didn't magically turn the 737 into an inherently unstable design which is not relevant to the issue of if the MCAS is covering up a large or small instability.
- Boeing did a good enough job with the airframe that the plane flies mostly fine but there are no miracles and some specific angle-of-attack and airspeed situations make it fall outside the rules.
- To bring the plane back into compliance they implemented a fairly simplistic solution in MCAS. Because the situation that is being fixed was fairly benign they didn't engineer it with triple redundancies.
- The lack of redundancy was understood to not be a big issue because the worst possible outcome is runaway trim and that's something pilots already train for anyway.
- The MCAS runaway trim presents itself in such a unique way that even experience pilots that are already warned about issues with the plane fail to diagnose it.
It's in this context that I would then like to know how unusual this situation is. If modern airliners all have these kinds of issues solved by control software then this is just another failure mode that needs to be fixed. If instead it was indeed unusual to fix the aerodynamic issue with control systems then the discussion about Boeing forcing through with the 737 instead of redesigning becomes more important.
McDonnell Douglas also implemented something similar one of their DC' family of jets. I believe it was either the 9, 10, or 11. In that case it was to accommodate a smaller tailplane to decrease drag.
"I don't know" certainly does not translate to we don't know. Plenty of people know.
That is FUD. The level of instability was absolutely known to the manufacturer and certifying agencies before delivery, and even before first flight. The reason why I said "appears to have been far less" is because the summaries of this instability I have read did not describe it as major, and even now, nobody is pointing to the instability as a significant issue. The issue is with how it has been dealt with. Until information comes to light contradicting the information known publicly so far, it is unreasonable for me to be afraid of something I have zero evidence is an issue when evidence to the contrary exists.
In the strict sense of the term, we the public will never know. The same people who built the plane will provide a fix, the same people who certified the plane will do so again, the same people who were flying them will do so again, and we will trust them or we won't. Some more people will have their eyes on it, but again, we still won't know. That is the way most science and technology works. Everyone has their small domain of expertise and must trust others in their own. Mistakes were made, and most mistakes look stupid/obvious on hindsight, but they don't negate the capacities of the parties involved. All car manufacturers have safety recalls extremely regularly and we don't make them out to be criminals, nor do we make the certifying agencies pariahs. I personally find it an exaggerated response to lose all trust in everyone involved - especially since new models of planes regularly have more accidents in their first few years of flight, because they are hard to make and they have bugs. It also seems unreasonable for me to criticize a manufacturer for taking economic/market concerns into account when historically even the largest manufacturers are on the verge of bankruptcy semi-regularly. Realistically, they must. At the same time this specific decision does not appear to have been the correct one, but I don't demonize them for making it and even at my most cynical, they obviously did not think people would be dying because of it.
> Since there is no evidence the problems you are bringing up are actually problems
I didn't bring up any problems. I just said that the things you were claiming were true are not things we actually know to be true.
>In the strict sense of the term, we the public will never know. The same people who built the plane will provide a fix, the same people who certified the plane will do so again, the same people who were flying them will do so again, and we will trust them or we won't.
This is precisely true. Which is why I responded to you by describing the bunch of things we don't know. Chances are this will be fully fixed and we will get a very nice detailed report on how that was done. The actual engineering tradeoff of more inherent stability versus more control is something we don't even know enough to conjecture well about. That's what I responded to in your comment.
Recent 737 models, including the MAX 8, make partial use of fly-by-wire systems, such as the MCAS that's elicited so many hot takes recently. Airbus aircraft, by comparison, make heavy use of fly-by-wire systems, and have for years. In terms of functionality, it's perhaps the single largest difference between their product line and Boeing's.
On the other hand, the widebody 777 is the first Boeing product to go fully fly-by-wire, completely separating the pilots' control inputs from the aircraft's control surfaces in the way that all modern Airbus aircraft do.
If fly-by-wire is the problem - if, as you seem to suspect, these systems exist to compensate for the inherent flaws of aircraft designs which otherwise would not be able to stay safely in the sky - then these Airbus models, and the 777, should have pretty rough safety records, shouldn't they? We should expect to see these other aircraft fail due to problems of the same sort as affected the 737 MAX 8's MCAS, right?
Luckily, we don't actually need to expect anything in this case, because we have good information on the frequency, severity, and causes of airliner accidents more or less all over the world. Indeed, that information is so good, and so available, that it's a major scandal, and a fecund ground for conspiracy theories, in the rare case where it's not available, as with Malaysia Airlines flight 370.
Thanks to that information, we know that the safest airliner on the planet, by flying hours, is the Airbus A340, which has not yet had a fatal accident. Second is the Boeing 777, which has seen only 541 fatalities in its almost quarter century of revenue service - and that's counting the 298 souls aboard MH 17, shot down five years ago over Ukraine.
Both of these aircraft are about 25 years old. Both have full fly-by-wire control systems. And both are, by any measure, among the safest commercial airliners in the world. If fly-by-wire were intended to cover up for the deficiencies in basic aerodynamic design you seem to lump into the term "instability", is this the safety record you'd expect to see?
I also am unconvinced computers can mediate an airplanes aerodynamic design in order to achieve certification under this part, because again by my reading the expectation is that we (pilots and the flying public) can expect static and dynamic stability dynamic stability, laterally and longitudinally. Can computer control improve these behaviors? Sure. Can computer control make them more linear or consistent or docile or predictable? All of those things. But is it acceptable to have negative static stability, naturally occurring by design, in transport category aircraft moderated by computer? I don't think that's allowed but then I'm not deep diving these regulations either. What happens if all computer control goes down? You can't fall back on the natural static and dynamic stability of the airplane, because it doesn't exhibit those characteristics? That seems bad and not consistent with FAR 25.
However, if any such computer safeguards can be disabled (either by the computer itself becoming confused and removing those safeguards; or by pilots disabling them explicitly), I expect the pilot to be trained as part of the type certification requirements, how the airplane behaves when the safeguards are enabled and disabled.
I'm quite sure Boeing knows the answer to these questions. I suspect the FAA knows the answer to these questions. And when you say "we don't know" I think you mean HNer's engaged in discussion, who maybe aren't even aware that quite a lot of things are mandatory for obtaining transport category aircraft airworthiness certification.
I mean that the general public doesn't know that indeed. And thanks for the references, I'll look them up. The original post I replied to was specifically saying that what you are now describing is not allowed (these types of planes being unstable) should be acceptable.
The only really stable commercial aircraft are, perhaps, the bushplanes. They are not fast and not fuel efficient over any real distance.
https://www.youtube.com/watch?v=2pw4OE7gM2M
This doesn't follow. Not even fighter jets were inherently unstable before modern control electronics. Using the electronics to make the flight characteristics better is not the same as the airframe being inherently unstable.
Fighter jets are also, in comparison to airliners, not very aerodynamically efficient. They can be fast but burn lots of fuel while doing so. They are like a motorcycle compared to a bus.
Until they hit an AOA that puts the tail in the wind shadow of the wings. Then some will pancake. They can slip sideways into scary turns/dives and will not recover on their own. And they are delicate. It doesn't take too much force to twist them out of shape.
In a deep stall you can’t recover from, it’s because the aircraft’s stability is greater than its control authority, not because it’s unstable.
Other airliners have had undesirable parts of the flight envelope. The 727 for example has a high T tail, and it's possible to get into a deep stall, which is not recoverable because at very high angles of attack the elevators are in the turbulent air behind the wings. In the UK, the CAA required 727s to be equipped with stick pushers to prevent them ever getting close to this regime. This was due to their experience with a BAC 111 that deep-stalled and crashed in 1963. I don't think the FAA ever required this though.
(For those who don't know, a Deep Stall happens when the horizontal stabilizer gets in the "air shadow" of the wings, hence you can't get airflow there to move the plane)
Some interesting discussion on t-tails and deep stalls http://www.rbogash.com/Safety/deep_stall.html
It won't "take itself" but possibly just a very light pull would stall the plane in some situations, and that is the very safety problem which Boeing tried to solve with MCAS, while keeping silent on its existence, because the plane is behaving differently than the one for which the pilots trained. Which is the opposite of how the plane was advertised and sold.
So any time when the MCAS is off the plane behaves differently than the one for which the pilots trained, therefore "just keep it turned off" was also not an option.
And we don't know how "light" is light, it can really be the case that it's even dangerously light.
Was the need for MCAS really so infrequent ("never during the pilot's career" -- are you aware how seldom it is?) the planes would simply have MCAS completely disabled and fly as we speak. That would be the full content of the Boeing's "software fix.
It's obvious that MCAS has to be kept turned on as soon as no autopilot is activated. (I'd also like to know how non-redundant (i.e. max 2) faulty AoA sensors affect the autopilot, by the way -- having just read that the modern Airbuses have four of combined AoA-speed sensors).
"But it's just because of the regulations" -- don't forget these regulations are there to minimize the number of crashes. And the regulations eventually in this case reduce to as simple as "the pilots have to be trained for the plane if the plane behaves differently." Which they weren't, and the latest Boeing claimed on that topic, after the two crashes was that the "one hour iPad training" will be enough(!?) And we now even know that Boeing was even allowed to do the certification process for themselves instead of FAA doing this.
Actually... Wasn't there a famous case where the pilots managed to save a plane without engines by just gliding to an airport? Would such a thing even work on the MAX design?
Ah yes, here it is: https://en.wikipedia.org/wiki/Air_Transat_Flight_236
Yes, because the problem with the MAX is that the engines provide an off-center-of-gravity thrust. If the engines weren't running, the MAX would glide just like any other 737.
There is also the case of the Gimli Glider [1], and any commercial airliner is certainly capable of "gliding" for at least some time, but I think the GP was adhering more to the actual definition of "glider" [2], which is an aircraft that can fly entirely without power from any engines at all.
1: https://en.wikipedia.org/wiki/Gimli_Glider
2: https://en.wikipedia.org/wiki/Glider_(aircraft)
MCAS has one function: give the MAX 8 flight characteristics that are similar enough to previous versions to not require significant training.
In fact, it's only when the engines are actually working that you'd need this... they're more powerful and further forward, meaning that at high thrust the aircraft will have more of a tendency to pitch up.
List of airline flights that required gliding
https://en.wikipedia.org/wiki/List_of_airline_flights_that_r...
including several 737's (plain ones, not "MAX"), most notably:
https://en.wikipedia.org/wiki/TACA_Flight_110
An open question I haven't yet been able to determine is to what degree software is an acceptable mediator to compel such behaviors. But I'm very skeptical that it's acceptable at all, let alone by something that can be intentionally disabled with two switches as a troubleshooting/override, and then also not require any difference training for the new behavior that ensues.
Whether MCAS exists strictly for FAR 25 airworthiness, or to avoid a different type rating for the pilot under FAR 61.31 from any other 737, it's questionable how you get around either of those things once it's disabled on purpose as a emergency/troubleshooting technique.
Which is worse upon setting STAB TRIM to cutoff? That the airplane isn't legally airworthy? Or that the pilot isn't legally type rated? Or even possibly both? And was either the case with the previous 737 models? Definitely not.
Sorry, but this isn't a credible comment.
Modern engines run bigger slower fans to reduce fuel consumption and noise. Bigger engines don't fit under the wing.
The engine fitment issue has been around since the 737 went from JT8D -> CFM56, hence the punched in the jaw look of most current non MAX 737s.
New generation, bigger engines, same form factor. Sure they could've redesigned the half of the plane but then it's not really a 737.
That is exactly the budget and time bit - lots of time and money for Boeing spent designing a new airframe, then the "not really a 737" part means lots more time and money spent by Boeing getting it certified, and lots of time and money for their customers in getting their pilots trained for the new plane.
A factor of 10 cost difference 'if they had only done x' isn't realistic.
Completely agree with your additional point though, the competition was the A320neo and the us vs them economics look better if you don't have to pay pilots to sit in a simulator and re cert.
https://www.flightglobal.com/news/articles/boeing-disputes-7...
Or does Boeing sell MAXes without that screen altogether? The Boeing update page (https://www.boeing.com/commercial/737max/737-max-software-up...) says it is the "baseline primary flight display" , so sounds like it would be included in all MAXes already, so no physical change may be necessary.
This blows my mind and reeks like other product management decisions I’ve faced in my particular industry where someone said “make that a feature we can enable so we can charge for it”. And they did charge more for it. Now everyone will get it free.
Edit: here’s a source for the claim that there’s always two physical AoA sensors installed anyway: https://aviation.stackexchange.com/a/61109
For example the vital computer compares a coded key compiled in the executable code with one read from a physical dongle. If it does not match, the system refuses to start. The dongle must be replaced separately by the person installing the software.
It’s just an example. There are plenty of variants possible.
There are usually also check lists, where the running version is displayed and verified on a safety related display to confirm the upgrade succeeded.
I find it interesting how airplanes jam as much information as possible in wherever they can.
Google search for "737 yoke checklist" reveals a variety.
https://cimg7.ibsrv.net/gimg/pprune.org-vbulletin/960x600/ao...
It's not until some poor, senior engineer, who is probably one of their best staff, has a stellar reputation, and genuinely cares about their job, their team, the product, and the company ... they have to fall on the sword and TELL management what's going happen: we're not shipping this yet, IT IS NOT SAFE. Then that goes all the way up the chain, management at every level wrings their hands, "how oh how did this happen?" (although they specifically are talking about the missed deadline, not the safety concerns). It gets high enough that feeling is overcome by senior leadership wrath, which flows back down, and ultimately that engineer and their entire team is punished.
What a dumpster fire.
If you know what's going on, MCAS is quite safe - there are two highly visible switches that kill electric trim completely (thus disengaging MCAS) and allow the pilots to take manual control. Activating these switches is a memory item (i.e. pilots have to memorize the checklist) for runaway trim and would be universal across 737 variants.
Unfortunately, it appears that both the Lion Air pilots and the Ethiopian Airlines pilots did not recognize that this was a runaway trim issue at all (or until it was too late). If the Ethiopian Airlines disaster turns out to have an identical cause to the Lion Air crash, one has to question why the pilots did not take this simple corrective action.
Boeing did not want to sell the training as an add on package, they didn’t want more training at all. This reduces the cost to purchase the 737 Max, because existing 737 pilots can fly the max without recertification.
What was sold as an add on was the system to detect the two AoA indicators disagreeing. This would help, but it probably would have been less effective than MCAS training would have been.
Better still would have MCAS read both sensors and disengage when they disagree, with an alarm.
A few hundred people who died as a result of MCAS would disagree. MCAS is not safe as currently implemented, or the 737 Max would still be flying.
MCAS on the other hand is basically a bad hack that was necessary for business reasons. It's a serious step backwards in safety from previous iterations, which has not happened with modern nukes.
Airplane certification is expensive for both manufacturer and airlines that might want to fly it. So there is a quicker process if you just make minor revisions, a reasonable compromise on the surface. Certification is so expensive and not having to retrain pilots is such a huge selling feature it creates a pressure to make planes that meet the same type requirements rather than design new airframes.
Boeing is all set to design a new airframe to replace the 737 that will be more fuel efficient and be built for today's point to point flights. Along comes airbus with the a320neo (new engine option) that kills the 737-800 on fuel efficiency and Boeing panics. They scrap 2020 plans for a 737 replacement and design the MAX. Now the problems mount. Fuel efficiency needs turbines that spin slower but have more surface area and are therefore larger. 737 is a low slung plane, dating back to hub and spoke flight concepts where the 737 might land places that don't have jetways. Since the plane is so close to the ground, Boeing has to move the engines forward so they can raise them. This generates more lift than previous 737s, but to meet same type requirements the plan has to be the same. Not meeting same type means they can't sell to airlines like southwest who only fly a single type and any airlines who do commit will have to spend training dollars, raising the total cost of operation without adding anything to the bill of materials.
Enter MCAS, a system designed to meet the same type regulation with disastrous unintended side effects. Side effects made much worse by the fact pilots don't know the system even exists since this plane is the same as every other 737 as far as they know.
I don't think the same type regulation should be scrapped since it would stop things like fuel efficiency gains during an airframe's lifespan, but there needs to be a same type minimum training and documentation that has to be done even if the only thing you change is thickness of the paint. If anything the definition of what meets same type should be slightly expanded allowing more flexibility in what can be changed. Combined with mandatory training for all subtypes (but still much shorter than different type training) the perverse incentive to make the plane behave exactly the same is removed. That leaves room for the better technical fix to win the day rather than the one that will meet the regulation. Training costs will go up some, but less than full different type certification.
There's a nasty rumor that Boeing agreed to pay Southwest $1 million per plane if additional training was required. That's a lot of money just on the Southwest contract. If any other airlines (e.g. Ryanair) demanded similar that's a huge chunk of money.
I see this entirely differently -- the FAA was being way too lenient/cozy with Boeing, and took their word that the airplane operated exactly the same (even if it didn't). This to me indicates that harsher regulations are needed, not less harsh ones! In what other industry do manufacturers self-certify such safety-critical machines?!
Relax regulations and we'll just start seeing more of those crashes that have killed so many airline passengers previously. It's a proven fact across all industries since time immemorial; companies don't make things safe out of the good of their hearts, and are OK with shockingly high body counts. Governments have routinely needed to rein in companies that were playing fast and loose with safety.
Place a random passenger into the cockpit of a modern commercial airliner without training and ask them to fly the thing safely and you'd probably have a 100% loss rate.
This ultimately is not a training issue. Why was a system that can potentially plow the aircraft's nose into the ground utilizing only a single sensor without any redundancy in place? Boeing screwed up. Now both sensors will be used. Great, but sometimes 2 sensors fail. If pilots that operate these aircrafts are trusted with the lives of 150+ passengers, they should have an "easy button" to take complete manual control of the aircraft. My human sensors should trump any mechanical sensor(s) when my life is on the line.
Activating those switches cuts off electric trim and would completely deactivate MCAS. It can be done in seconds.
Are there other feedback mechanisms present that can interrupt that determination?
That appears to be the case in these scenarios. The MCAS doesn't perform the incorrect action continuously, it looks like initial corrective measures fix the problem until they suddenly don't.
That's great...if they'd understood that the system was malfunctioning...but they had no such indication because their airline didn't pay for the optional "feature."
And then what? How much longer will it take to manually move the stabilizer to a suitable position? How much time do the pilots have at under 7,000 ft AGL? Will the elevator have to be moved nose down to unload the stab before the stab can be retrimmed?
It retains no memory of being overridden by pilot input but will keep pitching down until cut-out of the loop or the aircraft exits what it thinks is the dangerous corner of the envelope. Unfortunately it often lacks the information to make that determination correctly, due to the poorly-designed sensor integration.
That sounds like something right out of the 'Catastrophic Failures' books we studied in uni.
If that was the only issue, the plane would have not been grounded.
But it seems here on HN there's this persistent idea that it's just fine for the plane to start misbehaving and it's "only" a matter of the pilots fixing it.
Sure, why not, let's all run a cronjob that gets a random number, then beeps and wipes your computer every 1/100 times. But hey, it will beep and you'll have 1 second to fix it, sounds good, right?
This attitude killed 300 people
There is always a trade-off with these types of decisions, and like it or not, every airframe certified airworthy has the potential to kill everyone on board without proper piloting.
I'm not saying that I'm letting Boeing off the hook personally, but as someone who has an avid interest in engineering things, I do understand the optimization points they were going for with the MAX, they found a physical design that could accommodate those optimizations, but they skimped or didn't put enough emphasis on communicating changes to pilots.
The pilots are the single most versatile safety system on the plane. Hiding or keeping from them the information they would need to form a checklist to handle this type of failure is the major failing here (given we assume there were no other physical configurations that could have been grandfathered in that wouldn't have involved an MCAS like system for certification). The root cause of that omission though may be traced to the minimal retraining requirement, which was absurd in the first place.
So far, aircraft with malfunctioning MCAS has resulted in 100% loss of aircraft.
At first, everyone asserted it was 'faulty sensor reading,' but later it came out that there's also faulty programming and the MCAS system has way more authority than originally specified to the FAA.
There’s about 40 seconds before the aircraft becomes unrecoverable in these 2 crash scenarios. It’s not pilot error.
It’s design, software, certification subterfuge, lax FAA regulatory posture, and limited pilot awareness and superficial training. Roughly in that order.
Add to that desperation, in that Boeing was keen to catch up with the Airbus 320neo, and didn’t want to build (and certify) an entirely new aircraft.
Plus an extra sensor and related systems most US 737MAX’s have was an option, and at least the Lion Air aircraft didn’t have it.
Demonizing pilots or belittling the training of the LionAir and Ethiopian Air pilots is offensive and not supported by the facts.
This is going to get worse for Boeing. Their only saving grace is that the airlines and military need them too much.
<pilot; not ATP>
When hundreds of lives are at stake, defense in depth is critically important. Planes that crash unless the pilot does the exact right thing in some rarely occurring situation are not safe. It's bad design. That's like saying that airbags aren't necessary in cars because if everyone just drove perfectly there'd be no accidents. Well guess what, no one's perfect, and building systems that require human perfection are bad engineering.
But here's the thing. It's impossible to train or have a checklist for every eventuality or combination of failures. In the end, it's up to the pilots to use good airmanship and fly the plane. If systems are interfering with that, disable them and fly the plane. Trim system doing something you don't want? Disable it and fly the plane. Instruments disagree? Set known good pitch and power and fly the plane. It was daylight in good weather. Look out the window. Fly the plane. Diagnostics can wait until the plane is flying again.
Those two aircraft were flyable. All they needed to do was flip a switch. And fly the plane.
I'm not in any way suggesting that the problems with MCAS or AoA data on the 737 MAX should not be fixed.
I personally find the AoA sensors failure to be unlikely in the case of the Lion Air crash as they were replaced in between the two problematic flights.
I most interested in seeing the final results of the Ethiopian crash. My suspicion is the MCAS has terrible software and is a bug-ridden mess.
If maintenance procedures for testing did not correctly specify that a retest must start, then restart the system to actually test that the repair was successful, then that replacement may have been tested while the computer was being fed data by the correctly operating sensor. They would have had to attempted a single boot between flights for the next flight to have flown with the untested replacement sensor. If they didn't test at all, then it's possible both sensors had a problem.
This is of course assuming that there is any retest procedure at all in the documentation given that the AoA sensor wasn't classified as safety-critical.
It really seems like the makings of a bad movie doesn't it?
That's why it's incumbent upon Boeing to let the pilots know about all of the systems.
Trim system doing something you don't want?
STS generally does this by design.
Disable it and fly the plane
Boeing claims that MCAS is a part of STS. Well, you can disable STS quite easily by pushing/pulling on the yoke. You cannot disable MCAS this way.
Which, notably, they did not run right away. The need to run the runaway trim checklist was pure guesswork on the pilot in the jumpseat's part. It took them several minutes of fighting with the controls before they finally killed the trim. They even re-enabled the auto trim after killing it, not initially recognizing that that was what had fixed the issue.
Not even the flight that survived correctly identified the issue initially. This really isn't a case of "see, these other pilots got it right". They got lucky.
The two problems present themselves differently enough that it's confusing pilots (runaway trim is continuous trim movement. MCAS is 5 seconds on, 10 second off).
This is a systematic training issue. Pilots have been trained to recognize runaway trim but not faulty MCAS.
The only real solution is extensive simulator training until pilots reliably diagnose MCAS activations and start the correct checklist, something which Boeing and airlines don't want to pay for.
> Unfortunately, it appears that both the Lion Air pilots and the Ethiopian Airlines pilots did not recognize that this was a runaway trim issue at all (or until it was too late). If the Ethiopian Airlines disaster turns out to have an identical cause to the Lion Air crash, one has to question why the pilots did not take this simple corrective action.
Not quite:
While the runaway trim checklist is a memory item, the symptoms that pilots train on in simulator presents runaway trim as a continuous event (the "classic" runaway trim being a relay becomes stuck and the trim just extends continuously).
So while they've trained on the correct response to save the plane, they've never actually been exposed to the symptoms that an "MCAS runaway" presents (stick shaker on the AOA too steep side when the plane is patently not in stall combined with speed warnings and an uncommanded nose-down that goes away for several seconds when the stick is pulled back).
The "backs off" part is critical when combined with the speed warning alerts and lack of continuous trim, because this makes the nose down easy to interpret as coming from the 737's speed trim system, which has existed for decades, and the net result is that the combination of symptoms seems to overload/confuse the pilots.
We have, now, at least 3 documented examples of "MCAS runaway" -- the two downed flights, and the prior Lion Air flight in which a deadheading pilot in the jump seat did suggest to cut the automatic trim, but ONLY AFTER several minutes of confusion in the cockpit. And even after disabling it, they re-enabled the auto trim initially and only re-cut it out when symptoms re-occured.
Which all boils down to: The MCAS system is in no way "quite safe". Safety is not a single line of defence, and the fact that at least 3 sets of pilots have struggled to identify the correct response to the MCAS issue indicates that the design of the system is flawed, because no system is safe when its sole and only fallback relies on humans 100% providing the correct response to a never-before-seen set of symptoms.
After the Lion Air crash, however, this information was widely disseminated by the manufacturer. If the Ethiopian Airlines pilots were not properly trained on this new scenario then there was clearly a breakdown somewhere in the chain of communication.
Detecting a classic constant runaway trim is an old drill for pilots.
Detecting a trim that gradually runs away, then stops to make the situation look normal, then runs away again until the plane is way off level flight is a new failure pattern.
It works for non-critical software where users can learn workarounds for only those problems they happen to encounter. But it doesn't, in the long run, work for cases like aviation where there is a known but growing set of special conditions that the pilots need to learn and remember even if they don't ever bump into them.
The reason is as you say, MCAS runaway (e.g. due to a failed AoA sensor) does not behave like a normal runaway trim (e.g. continuous trim movement). That is key. Watching Youtube videos was helpful in understanding what the pilot experiences. I initially thought the pilot should easily notice the trim moving because of the large trim wheel beside them. However, in normal takeoff, the trim is being adjusted automatically and so pilots learn to ignore it changing. Second, I think with the 737 MAX, the sound made by the trim wheel has been changed (removed)?
Using the stab trim cutout switches is a drastic measure (occurs as nearly last item on memory checklist) and, as I understand it, the only way to stop a misbehaving MCAS from doing its bad work. If the pilots are even a little slow in figuring out what's happening, I can easily imagine that leading to disaster. Also, if they to realize the problem and flick the switches off, manually cranking the trim wheel the other way takes time and it takes some serious physical strength to do it. I can imagine that if the MCAS moves the trim fully the wrong way, the pilots might not be able to fix it quickly enough.
Yeah, that's the 737's Speed Trim system. Even before the MCAS, automatic trim adjustments to adjust for the '37s behaviour at different speeds were a constant thing in the cockpit. It seems like one possibility here is that pilots may be mistaking or unable to distinguish (since there's no real differentiation) the MCAS' trim adjustments from normal Speed Trim adjustments -- and keep in mind a speed warning is going off the entire time they're fighting the MCAS, due to the malfunctioning AOA, so they may be primed to think "Speed Warning + Automated Trim periodically occurring == Speed Trim" and over-focus on the stall & speed warnings and ignore the trim component.
> Also, if they to realize the problem and flick the switches off, manually cranking the trim wheel the other way takes time and it takes some serious physical strength to do it. I can imagine that if the MCAS moves the trim fully the wrong way, the pilots might not be able to fix it quickly enough.
It's actually worse than that. If the AOA sensor is misbehaving, then it will never show a recovery after the MCAS applies an automatic trim adjustment, leading to the MCAS continuing to apply trim adjustments until the trim is at maximum.
At this point, the aircraft is basically in a nose dive, and if they hit the trim cutout, it can be physically impossible to manually trim the aircraft
An Avionics engineer discusses the issue here: https://www.satcom.guru/2019/03/aoa-vane-must-have-failed-bo...
> The standard response to just hit the stabilizer cutout switches and manually trim is actually flawed. If the nose has been pushed down by significant mistrim (nose down stabilizer, nose up elevator), and as airspeed increases, it may not be possible to trim the stabilizer manually nose up without letting the elevator go to a neutral position. The reality, under the MCAS runaway scenario, trimming nose up immediately stops MCAS as well as trims the stabilizer back towards an in-trim position. At that point, you would be best off to cutout the stabilizer.
> Many flight crews may not know that you have to relax the elevator to manually trim the stabilizer if the loads is too high.
It also mentions that the techniques needed to relieve the forces enough to make trimming manually possible are not necessarily covered in Boeing's current manuals -- because they completely ignored the possibility of the MCAS trimming to max downwards.
FAA emergency airworthiness directive 2018-23-51 [1]
We are issuing this AD because we evaluated all the relevant information and determined the unsafe condition described previously
And what it describes previously is MCAS when receiving erroneous AOA sensor input.
Also, your post basically says MCAS is safe when disabled, because in the very same sentence you claim it's safe you also claim the pilots are supposed to know how to (indirectly) disable it. That's almost comedy.
>why the pilots did not take this simple corrective action
It's a valid question why they didn't take corrective action; it's insulting and asinine editorializing to call it simple.
[1] http://rgl.faa.gov/Regulatory_and_Guidance_Library/rgad.nsf/...
Safety in an aircraft means getting passengers to their destination without injury or loss of life. Boeing failed here - blame lack of training, single sensor dependence or software if you like but there was certainly a failure.
Now no one really cares if MCAS is problematic - any solution needs to resolve the underlying fault.
This practice, fortunately or unfortunately depending on who you ask, effectively normalized deviance, and short-circuited the protection offered by that airworthyness regulation. It went from being clearly spelled out to "or equivalent level of safety" which opens the door to all sorts of workarounds.
The alpha vanes need to be a high-priority maintenance item. They may also need to be redesigned/augmented such that they can be hardened against typical failure states, or subjected to in-flight remediation/diagnostics and graceful failover.
That isn't easy from my understanding. Doing something like hardening vs. freezing would require some form of heating element, which would potentially effect the calibration of the sensor while active, and increase maintenance complexity. Adding some sort of self contained calibration unit to the sensor could work too, however, the more complexity built into that, the more costly it becomes.
There is a point of diminishing returns, and I do think the plane can be rendered safe with MCAS and pilot retraining.
Unfortunately, that will still come bundled with an aircraft losing its airworthyness rating on Stab Trim cutout.
No, it's not, and most of the regulatory agencies around the world agree. Pilots that Boeing handpicked to test out MCAS fixes (and thus knew what it was, what to do, and expected a problem) agree. And that whole runaway stab trim checklist is a red herring especially after Boeing has come out and said MCAS is a part of STS — itself a system that trims the stabilizer in a counterintuitive manner on the NG. The stabilizer operates in a counterintuitive manner on the NG and MCAS runaway doesn't meet Boeing's definition of runaway trim. Full. Stop.
https://www.nytimes.com/2019/03/25/business/boeing-simulatio...
Here's a relevant quote:
Those involved in the testing hadn’t fully understood just how powerful the system was until they flew the plane on a 737 Max simulator, according to the two people.
0. https://youtu.be/xixM_cwSLcQ?t=1016
I definitely agree that the MCAS system should have required two AOA sensors, and been automatically disabled when there was a disagree. I agree that Boeing should have briefed airlines and pilots about the MCAS system, the AOA disagree indicator, and potentially required new training.