My understanding is the software was fine, it was faulty sensors with no redundancy and poor feedback displays to pilots.
The software is quite flawed (and operates differently than how it was described to the FAA) but there are two (thus redundant) sensors being used in a not-so-redundant manner.
Unlikely as there are no readily available replacement planes for airlines who need to replace their fleet. Airbus can only produce so many, the supply chains and production facilities just aren’t there. Even if Airbus somehow magically increased their production by 50%, Boeing would still sell 2000+ 737 MAX planes (or the previous generation 737 models)
History suggests that people will forget this very quickly. I wouldn't be surprised to see Boeing 'rebrand' the plane as 737-8, but it probably won't be necessary.
The 737-800 is a 737NG. The model number for a 737 MAX-8 is 737-8. That's why I put rebranding in quotes -- it's already the official designation for the plane. I could see them dropping the public "MAX" branding from what they print on the side of the plane and just calling it 737-8 (and -7, and -9, for the other models) everywhere.
Three angle of attack sensors seems unnecessary to me. They simply need to make MCAS pay attention to both (2) and cut out if one disagrees with the other.
That's not important; you disable that “autopilot feature” and sound an alarm in the cockpit explaining what the exact error is. Should be enough for the human pilots to react properly.
You can't compensate because you don't know which one is wrong. However you can make MCAS inactive whenever the two sensors are disagreeing with each other.
This is why the parent poster is arguing for 3 sensors (and the real reason for tripling). If not all sensors agree but 2/3 do, it is more probable that the two sensors are correct than the 1 sensor disagreeing.
Right, but the MCAS system as it was implemented during those two crashes did not disable itself when the two sensors disagreed. It could have, but didn't. Boeing is apparently changing that, and I believe that change to be sufficient.
MCAS being automatically disabled when the sensors agree but leaving the pilots with electronic trim control seems like a perfectly adequate solution. The MCAS system was never even necessary for flight, it was only necessary for certification. In the situations where it's meant to be active, which are a limited subset of all high angle of attack scenarios, it's fine system to have if it's working correctly. But it should never be active outside of that limited set of scenarios. It should never be active when both angle of attack sensors aren't indicating a high angle of attack within a reasonable distance of each other.
Frankly, if two sensors are indicating a high angle of attack and one is not, it's probably still sensible to disable MCAS. I don't have any of the real numbers, but the chance of a 737 being in a low speed high angle of attack scenario is low in the first place, possibly sufficiently low that "two sensors being wrong and the aircraft being in level flight" might be more likely than "aircraft is near stall and one sensor is wrong."
To know for sure we'd need at least the hard data on what modes of failure these sensors have, how likely any of those modes is to occur and what the expected readouts from those failure modes are, and how likely a 737 is to encounter a low speed stall scenario. We, or at least I, don't have any of that. But my gut says that two sensors are sufficient iff the MCAS system is only active when they agree.
Furthermore, the chance of two sensors being wrong actually goes up if you have three sensors, rather than two. Correct me if I'm wrong, stats was never my strong point, but it seems to me like the cumulative binomial distribution is relevant here:
#lang racket
(require math/number-theory)
(define (general-binomial p k n)
(* (binomial n k)
(expt p k)
(expt (- 1 p)
(- n k))))
(define (cumulative-general-binomial p k1 k2 n)
(apply +
(map
(λ (k) (general-binomial p k n))
(range k1 (add1 k2)))))
Chance of a single sensor failing, if each has a 1% chance of failure (sanity check):
> (cumulative-general-binomial .01 1 1 1)
0.01
Chance of two or three out of three sensors failing, if each has a 1% chance of failure:
MCAS should turn off as soon as a single sensor fails, and three sensors are therefore unnecessary. Two sensors are sufficient to detect when a single sensor fails. If you only have two sensors and two fail, then MCAS remains active and your plane crashes. But that's not likely to happen. However that's more likely to happen if you have three sensors and try to use two sensors to vote out a third, in order to keep MCAS active when a sensor fails. In that configuration, a double failure (causing a crash) is three times more likely.
My conclusion is turn off MCAS as soon as even one sensor disagrees with the others. And if that's how MCAS is configured, then three sensors is unnecessary overkill. If you want overkill, you may as well double up the sensors on both sides and have four instead of three; all the better right?
Eh, that kind of makes a certain amount of sense, but I don't think that's quite right. Determining which of the two sensors is less-extreme supposes knowledge about the airframe's current state. If he aircraft is currently in a very high angle of attack low speed stall, then the sensor that says everything is A-Okay is the extreme sensor.
I understand that's not what you mean, that the sensor indicating a situation closes to nominal flight should be chosen, but I think the sticky part is that MCAS isn't a system meant for normal flight conditions. MCAS is only supposed to be active when the aircraft is in an extreme scenario. So in fact if the sensor with "less-extreme adjustment" is preferred, in a way that actually means the system functions as I suggested: MCAS is disabled if the sensors disagree. But not quite. In your scheme if both the sensors are extreme but disagree, MCAS would be active to the lesser extent. But in my scheme, if both sensors are extreme but disagree, MCAS would be totally inactive (while leaving the pilot with electronic stabilizer trim control of course, allowing the pilot to manually do anything MCAS would be capable of doing.)
No 737 has 3 AoA vanes, and it’s extremely unlikely they’ll ever change the design to accommodate that. Every MAX will have an indicator to show if they disagree though.
The problem is not the missing extra angle of attack sensor, but incompetence at every step.
If I understood correctly, MCAS trimmed it so much that the pilots were unable to bring it back manually.
This sounds like Boeing engineers didn’t even put a limit on the maximum trimming that MCAS can do, not even to the maximum theoretical limit for the plane/engines.
MCAS trimmed it so much that the pilots were unable to bring it back manually.
Not only that, MCAS controlled an electric motor which turned the trim wheel and which could apply more torque than a human turning it manually. The only way to disable MCAS was to cut power to that motor. MCAS pointed the aircraft at the ground, and it was impossible to trim the aircraft to achieve level flight again.
Mind, MCAS was supposed to be a crutch to fly at the edges of the flight envelope, something that a regular pilot would never encounter because under normal conditions pilots wouldn't find themselves in a regime where MCAS would be activated. That was the idea, instead we had two hull losses within 6 months!
The electric trim adjustment is obviously going to be more powerful, that's just the reality of large planes. That's not the issue.
The issue from the Ethiopian crash was that, in the extreme trim angle, there was simply too much force on the screw to turn manually. This condition is trained for, and the solution is to let the plan angle down to relieve the aerodynamic pressure on the control surface. That gives you an opportunity to manually control the trim wheels.
The pilots did not have the benefit of altitude to perform this maneuver, so (likely) instead re-enabled the electric trim in a bid to use it to reduce the nose-down trim before the MCAS would re-engage. This proved fatal.
Are you suggesting with the auto-trim disabled, the two pilots working together, with those handles extended on the trim wheel, were not strong enough to crank the trim wheel?
It's very easy to see the two AOA sensors on a Boeing jet when it's parked at the gate--there's one on each side of the plane. What I don't know is where Airbus puts the third one.
From aviation it could be the De Havilland Comet. But that brought the whole company down. So let's hope this will not go there. Airbus having a monopoly is no ones interest.
That is unlikely. The A320neo family currently has an order backlog of over 6000. The only airline I know that is actually pursuing cancellation is Garuda. Given that the A320neo family is really the only competitor to the 737MAX family airlines don't really have anywhere else to go.
I also doubt customers will really vote with their feet given that the number one factor when booking a ticket is price. If some people choose not to fly on them it will create supply/demand imbalances in the market which would be interesting.
Yes. Take a look at the issues Boeing had with the 787 production or even just the distance which both Airbus and Boeing ship giant pieces of airplane.
Airbus currently builds about 660 A320s per year. At roughly $100 million apiece, that’s about $66 billion per year of product. How many other manufacturing companies produce that much stuff? And this sort of low volume, high value manufacturing is a bad fit for the sort of automation that allows, say, Toyota to build 10 million cars per year.
> I also doubt customers will really vote with their feet
Agreed. As the article points out:
"Passengers eventually returned to flying the 787 and to other airplanes that were grounded: the McDonnell Douglas DC-10, the Douglas DC-6, the Lockheed Constellation and even the de Havilland Comet."
I'm not sure the DC-10 is a great example. It was grounded in 1979 and discontinued in 1983 after airlines stopped ordering it. The company never recovered and died a long and slow death until Boeing scooped them up.
Neither is the Lockheed Electra (one would guess that the author means that airplane instead of the Constellation). Airlines cancelled their orders and Lockheed had to end production of the model early, leading to very substantial losses for the company.
I'm honestly surprised they're not cutting back production more than this. If I was an airline that thought long and hard about whether to order the 737 Max or the Airbus A320neo, and ultimately decided on the Boeing, these events, and the likelihood of recertification and further training requirements for pilots might well make me reconsider that decision.
If Boeing really needed to cut these corners in order to remain competitive, then having to redo those corners might make them too expensive or inefficient for the market.
This is not my domain, but it reminds me of financial fraud, accountability of those at the top, and the consequences they face.
I was studied accounting in the wake of the major accounting scandals of the late 90's/early 00's. The Sarbanes-Oxley legislation was passed. It states that the CEO and CFO are directly responsible for their company's financial statements.
AIG was the first major accounting fraud post Sarbanes-Oxley. Investigated by the SEC, determined non-criminal, CEO stepped down, and that was his consequence. [1]
Boeing's CEO, Dennis Muilenberg, has the blood of 346 people on his hands. He is at the top, it is his organization, and his responsibility. I hope an investigation determines if it is criminal.
I think one of the major shifts I would like to see in our society is holding those in power to account. Whether it's accounting, aviation, banking, it doesn't matter. As it stands those at the top rarely pay for their malfeasance.
I'm pretty familiar with how all this works on the FDA side with medical devices/software.
If it's the same general setup as on the medical side with the FDA, then it's a virtual certainty that liability will fall with some compliance and QA types, as well as any engineers or engineering managers who signed the relevant documents. Those signatures are all legally binding, and represent to everyone up the chain that the systems in question are functioning properly. If the government can show that the systems in question could not have been functioning properly, they got you. (Another thing we learned from our lawyers about the FDA side, each document that you signed, represents one count of lying to the federal government at a minimum. Multiply that by the number of documents signed to get a single system through, and you get an idea of why you should never sign anything if you have any reservations at ALL. No matter how slight the reservation. No matter how much pressure the higher ups put on you. I think the rules are the same on the FAA side. So these guys have really stepped in it.)
That said, they may be able to snag a few executives here or there, but only if they can prove who knew what, and when. Execs, you would think, would be pretty careful about liability type things, so they could look very hard and not find anything on any of the execs. It would not be collusion or preferential treatment, it's just hard to find that kind of a smoking gun in a mountain of electronic documents and messages. (I strongly suspect that if the government were to press hard enough though, that some of the engineering managers and compliance types would turn state's evidence to get lighter sentences. At that point, you could probably get some execs I'd imagine? Still might be hard though.)
The engineers and QA/Compliance folks, though, should really be consulting with outside counsel. Just as a precautionary measure. I wouldn't trust Boeing execs to not throw me under the bus.
And this time around, it looks like a pretty big bus. I don't think you survive this hit.
Like the Toyota unintended acceleration issue we need third parties to look at the flight control software and engineering decisions taken for the MAX line and give a an independent report.
Certainly not the FAA who delegated their oversight to Boeing.
At best, stricter regulations may have resulted in a different design to comply with US regulations. The FAA is not a global organization, they don’t have oversight over any of the crashed aircraft. So, it’s tricky to place blame on US regulators for foreign crashes.
Blaming EASA/FAA/Boing etc feels good, but calling them inept becase they are not perfect is overstating things. Looking back it seems like an obviously bad call, but that’s hindsight bias.
I did not blame FAA, I was just pointing out why your logic was flawed. Just because the plane crashes did not happen in the US does not mean that the FAA may not be at fault. The FAA had approved the plane and it was operated the same way in Africa as in the US so it is just chance that none of the crashes happened in the US.
FAA has many regulations that most of Africa does not.
So, no they where not operated in the same fashion. It’s still been grounded in the US for good reasons, but you can’t take individual regulations in isolation.
While in a de jure sense this is true, de facto the FAA effectively does have oversight over many (maybe most) commercial aircraft all over the world. Small countries in particular do not have the resources necessary to exercise meaningful oversight over every type of aircraft on the planet, and defer to FAA decisions in virtually every respect for Boeing and other American-made aircraft, and the US FAA and NTSB are involved in the investigation of virtually every incident involving a Boeing aircraft anywhere in the world.
Even larger, well-resourced geopolitical entities like the EU rely heavily on the FAA to do its job for Boeing aircraft, much as the FAA relies on the EASA to do its job for Airbus aircraft. It's not pure rubber stamping, but it's close enough that things like this can pretty easily happen if a manufacturer's home agency falls asleep at the switch.
An example of the FAA's influence: Airworthiness regulations are so closely coordinated that special numbering is used by Canada, Europe, and Japan to match the numbering of FAA airworthiness regulations for easy cross-referencing. The FAA is also delegated air traffic control responsibility for much of the world's international airspace by the ICAO.
It is basically impossible to fly a commercial aircraft on Earth without being under the – possibly very heavy – influence of US civil aviation authorities, and it would take a great many resources and serious, concerted political will by many countries to change that.
> The FAA is not a global organization, they don’t have oversight over any of the crashed aircraft.
The FAA has bilateral agreements with other countries and the EU for certification[1]. I read recently but can't quickly find in this that the FAA trusts EASA's certs for Airbus flying in the US.
The Ethiopian agency also trusts the FAA and EASA for this information[2]
So, it's not really tricky here, we can blame the FAA for the crash of a US manufactured plane in a foreign land (if the problem was the FAA's certification process).
Edit: The entire point around these regulations is managing trust. Aircraft manufacturers are trying to build safe aircraft, the question is how much oversight is nessisary. EASA largely trusted the FAA and the FAA largely trusted Boing which they need to do. EASA can’t verify every bolt, they need to trust the manufacturer’s process to some degree.
So, EASA can’t really abandon blame as easily as they abandon responsibility. If they allow a flawed process to continue then that’s on them.
However, in this case these agreements still give EASA veto authority about what aircraft are allowed. Which is why EASA was able to ground these airplanes before the FAA did.
Toyota never had an “unintended acceleration issue”—that was purely human error. A Toyota engine can’t overpower its brakes, unless there was gross negligence in the care of the brakes, i.e., they were totally inoperative. Just to make sure we’re clear on the braking thing: if you were to accelerate a Toyota sedan (any of them) to 70mph, then stomp on the brakes while holding the accelerator to the floor, the car will absolutely come to a complete halt in about the same distance as if you didn’t have your foot on the accelerator. Here’s another thing to back up my claim: how do you think burn outs work?
This doesn't mention the horrible spaghetti code NASA found when reviewing the code. 250k lines of C with thousands of global variables. It leaves a pretty bad taste.
Then again, I still wouldn't be surprised if most people were just too perplexed if their car suddenly accelerated like crazy and not stay calm and hit the brakes as hard as possible right away. It might take you a second or two to get what's going on, and by then you might already have lost control.
I can't speak to what most people would do, but I've experienced unintended acceleration before. The throttle stuck all the way open while I was driving a friend's car because he routed the throttle cable improperly after installing a larger carburetor for more power. I had intended to give it full throttle, but only briefly.
I stood on the brakes and didn't let up. He reached over and shut off the key, which locked the steering and put us in the ditch, but at relatively low speed due to the continuous braking.
No, and I haven't driven a car with that behavior. Most US market cars have a sequence of lock, off, accessory power, on, start as the key is turned farther clockwise. Some cars require manipulation of a lever near the key to reach the lock position.
Very new cars with an entirely radio-based "key" might behave something like that.
>Then again, I still wouldn't be surprised if most people were just too perplexed if their car suddenly accelerated like crazy and not stay calm and hit the brakes as hard as possible right away. It might take you a second or two to get what's going on, and by then you might already have lost control.
Without electronics or software involved, many years ago (1980's or so) there was a FIAT diesel engine, that was widely used on mid-sized cars, typically the Ritmo (Strada in the US) that had a servo-brake working by depression coming from the engine that had a defective membrane.
Basically, it could happen that the membrane broke/got a hole in it and the oil from the engine would enter the combustion chamber, to the effect that the engine would go up at full revs.
And you couldn't switch it off, the only way was to depress the clutch pedal, put in fourth or fifth gear and brake hard while releasing quickly the clutch.
It was a terrifying experience for someone not very familiar with cars/engines, though most people using a manual gearbox know that by depressing the clutch and braking would stop the car (so no or few accidents caused by this issue), knowing how to forcibly turn off the engine wasn't (and still is not) common knowledge, the motor would continue going on for a few minutes until something else would break or the oil in the engine would have been mostly burned (leaving the engine with no lubrication at full revs) until the engine would seize up.
if you were to accelerate a Toyota sedan (any of them) to 70mph, then stomp on the brakes while holding the accelerator to the floor, the car will absolutely come to a complete halt in about the same distance as if you didn’t have your foot on the accelerator.
Are you saying the additional, let’s say, what?, 60kW of power being applied to the wheels will require no additional effort at the brake pedal to overcome.
Colour me unconvinced.
I’ve never tried to imitate a burnout at 70mph / I’m not convinced the circumstances are the same.
Assuming a properly-maintained braking system, it makes very little difference.
>And despite dramatic horsepower increases since C/D’s 1987 unintended-acceleration test of an Audi 5000, brakes by and large can still overpower and rein in an engine roaring under full throttle. With the Camry’s throttle pinned while going 70 mph, the brakes easily overcame all 268 horsepower straining against them and stopped the car in 190 feet—that’s a foot shorter than the performance of a Ford Taurus without any gas-pedal problems and just 16 feet longer than with the Camry’s throttle closed.
While you're right that the engine will not overpower mechanical braking, I think the bigger problem is that modern hybrid and electric cars have been moving to brake-by-wire so that they can balance mechanical braking with energy recovery.
The result of Toyota's firmware audits were terrifying [1], and I think it's still reasonable to be concerned about potential issues here. If the brake-by-wire system were to have firmware issues, your point would be moot.
The thought that Boeing probably needs a similar audit to shine light on some dark corners and encourage them to clean up their act also seems quite reasonable.
No, that was never proven, and as another poster pointed out, the independent audit of Toyota's practices suggests that random and uncharacterized faults in Toyota's ECUs cannot be ruled out as causes for the unintended acceleration episodes.
As another sign of this, Toyota both stonewalled the investigation and later fired the director of the division in charge of ECU engineering, and rebuilt the division.
>the independent audit of Toyota's practices suggests that random and uncharacterized faults in Toyota's ECUs cannot be ruled out as causes for the unintended acceleration episodes.
>cannot be ruled out
That seems like a very weak statement. If you asked a software auditing firm to inspect your massive codebase they're not going to "rule out" any bugs either.
Have you read the independent report? The point of the report was that their engineering practices (both software and hardware) were so extraordinarily dangerous, the ECU was impossible to test with any authority. Its behavior was effectively non-deterministic in many of their cars from that era.
That's sort of the point. I'm not defending their code. I'm pointing out that even if the code were immaculate, it would be hard for an code auditing firm to say "this has no sudden acceleration bugs". It's a very CYA statement.
I thought the problem with braking to overcome a runaway engine was that people don’t commit to it. If you brake hard to a stop then it will work, just like you say. But if you brake some and try to figure out what’s wrong and brake some more and let up and fiddle with the accelerator and brake a bit more and on and off like that, you’ll overheat them to the point that they won’t be able to overcome the engine anymore.
I agree with your first statement that it's clearly human error but I disagree with the argument about burn outs. Static friction is an entirely different mechanism than kinetic friction. The force needed to stop the car in your first scenario is kinetic friction. Burn outs work by static friction. In general, static friction is the higher of the two.
Is there a percentage pie chart for what was used on the MAX? Like 80% Ada, 15% C++, and 5% C? I wonder if we'll see a move to things like Spark where proof verification becomes more standard? I don't know much about avionics software, so any educated comments are welcome.
> Is there a percentage pie chart for what was used on the MAX? Like 80% Ada, 15% C++, and 5% C? I wonder if we'll see a move to things like Spark where proof verification becomes more standard? I don't know much about avionics software, so any educated comments are welcome.
It's not about software verification. In this case, the verifier would have given it a pass (with respect to this particular accident).
It's about bad management/bad requirements:
- "minimization of pilot training is the overarching requirement"
- "it's okay to feed only a single sensor into MCAS, even though there are two of them on the plane"
- "it's okay to sell critical safety equipment as options costing extra"
- "it's okay to not tell any pilot about any of this, since we practically didn't change anything".
Agreed that static analysis/proof verification only gets you so far. I was just thinking that the visibility of the incident might lead to some companies asking how they can go even further to make things safer. Of course the first and most important steps consist of what you're saying above, followed by doing whatever they can on the software front if they aren't doing it already.
Yeah there was exactly one single point probably mechanical failure, the AOA sensor.
I'm coming down on the side of the cause of these accidents was due to the failure to properly type certify the aircraft. Because they were trying to avoid that they failed to do the system analysis and testing including simulator testing that would have easily found this.
This might be too hot of a take for HackerNews, but... look at how many people the FAA has kept safe over the past 30 years. I'm pretty sure the number of people who travel without dying is very, very high. I don't disagree that their might have been some ineptitude (I'm sure you could find that anywhere for anything since it's opinion driven), but to say the FAA is all rotten because 346 died is kind of dramatic when millions have been kept safe.
The problem is not that this is a big number of deaths in an absolute sense. The problem is that this is a big number of deaths to result from a chain of events that can ultimately be traced back to a strategic decision by Boeing to increase profits, and where an explicit component of that strategy was to cut corners on training. The whole point of MCAS was to avoid the overhead of having to obtain a new type certificate for the new engine design, and that lead to 346 deaths. That's the problem.
All deaths can be traced back to some kind of profit motive, but I don't see you protesting every hospital/doctor on the planet.
It's incredibly dangerous to propose changes to the FAA, given how much of an unqualified success they've had over the years at keeping flight safe. Don't let y our populist rage kill probably one of the best/most successful government institutions the US has ever created.
> It's incredibly dangerous to propose changes to the FAA
That is an incredibly ironic thing to say, because these deaths are a result of changes to the FAA, specifically, the delegation of the FAA's regulatory authority to the company being regulated. That this would not end well was easily foreseeable because it's such a blatant conflict of interest.
Then you don't understand irony. Which is itself ironic.
I was using the word in this sense:
"Irony: a literary technique, originally used in Greek tragedy, by which the full significance of a character's words or actions are clear to the audience or reader although unknown to the character."
This isn't a story, and I am not a character. If that's what you were using it like, you are wrong. It'd make at least some sense if you incorrectly meant "irony" in the sense that fucking with the FAA, which I said was bad, is how the MAX was made so poorly.
Your fake choice of definition is even worse than what you actually meant.
It is possible to see irony in real world statements, actions and situations; "irony" is not strictly the name of several literary or dramatic devices.
Of course it's possible, it's just not present here. I never said irony was exclusive to narratives, I said the irony he's failing to accurately point out is.
Is this written into law, or is it "well, you at least need a ferry certificate for anything built in the US, because what're you going to do, push it onto a barge?"
My question is "is it illegal to manufacture an airliner in the US without FAA approval, providing it's never actually flown in the US?"
It's somewhat abstract, but it's an interesting question to me, which is why I asked. Does the FAA's authority to regulate aircraft construction come from Congress specifically delegating authority over aircraft construction to them- or does the FAA only effectively have the ability to control construction because they can prevent the aircraft from flying in US airspace?
I have no knowledge about the actual process, but can only assume that everyone is allowed to build a plane. But flying it is ~probably~ hopefully the thing that‘s regulated.
Certifying aircraft is a long and expensive process. So generally speaking, aviation authorities 'share the burden' by relying on each other. By the same token, the FAA will take an EASA certification of an Airbus aircraft as valid without much additional checking.
FAA's reputation alone was good enough for other aviation authorities to accept its certification of Boeing's MAX 8, which is why the FAA matter despite happening way outside its jurisdiction.
And both Boeing and the FAA have some credibility to win back here. If they don't, other aviation authorities might not trust the FAA's judgement on Boeing airplanes in the future.
I do not see anyone condemning the last 30 years of FAA, just the more recent work. Would it not be appropriate to criticize a significant fall from their earlier high standards?
And yes the numbers are not the only relevant issue. It is the manner in which the original certification was done, the failure to act swiftly after the first crash, and the inordinate delay in acting even after the second crash which together seem to paint the picture of an organization which puts the interest of the manufacturer above passenger safety.
Do you mean to argue that Boing and the FAA and / or any other regulatory bodies who approved the 737MAX should get a free pass due to their outstanding work over the past 30 years?
That doesn’t sound like an argument anyone would intentionally make.
They’ve done good work, great. But these two incidents represent a fall from grace, and both organisations should be pilloried for that incompetence especially because they have a history of high standards.
Exactly, it's not about the "blame" is some abstract sense, it's about the process that has to be permanent in order to keep the risk low. Different people already mentioned here a work of MIT Prof. Nancy Leveson
An important quote from her book "Engineering a Safer World" section "Questioning the Foundations of Traditional Safety Engineering":
"Old Assumption
- Major accidents occur from the chance simultaneous occurrence of random events.
New Assumption
- Systems will tend to migrate toward states of higher risk. Such migration is predictable and can be prevented by appropriate system design or detected during operations using leading indicators of increasing risk."
So it's: either the organizations are themselves able to keep the risk from increasing (as quoted, that is even "predictable" and of course it "can be prevented") or there have to be the external influences in that direction.
In this case, the organizations themselves failed.
I believe the saying is "FAA regulations are written in blood" in that new regulation is written after people die from a design defect or other discovered problem in the wake of a crash.
Thus there is a discrepancy between your perspective / opinion and the typical way that the NTSB and FAA operate: this is precisely the time to address any issues.
All it takes to destroy a great reputation is one massive moral screwup. That's what happened here. And all over a relatively minor technical and economic issue: whether to require additional training. (Also there is the issue that two sensors is not enough redundancy, and using only one of them is a result of that lack of redundancy.)
There is more: the airframe of the 737 MAX is not in and of itself stable. Because of the forward positioning of the large engines, the MAX's airframe has a tendency to pitch up when accelerating. Boeing decided to fix this hardware problem with software. This is flawed design. In a multi-layer system, each layer should be intrinsically safe. The job of the higher layers should be to add functionality, not fix flaws in lower layers.
This is a fundamental point, the entire stack is broken. Fixing the software is just a patch. It is quite possible that in the end, the 737 MAX will be abandoned.
All aircraft with podded engines under low-mounted wings have that tendency to pitch up when accelerating. This is nothing new.
The 737 MAX additionally has a tendency to pitch up when pitching up. The more you pitch the aircraft up, the more it wants to pitch up. As you pitch up more and more, you'd like the required force on the controls to increase, but in the 737 MAX it would naturally decrease.
The FAA has not been an unchanaging entity operating under an unchanging set of rules for the past 30 years.
In reality, major changes have been made to the way that the FAA operates and delegates authority in a series of sweeping changes since 2005 that were largely meant to cover for the fact that Congress has been severely underfunding the FAA.
The MAX is one of the first models we’ve seen wholly designed and manufactured under this new process. (substantial amounts of the underlying safety analysis of the 787 happened under the old setup)
One major change that may be relevant in this case is that whereas Designated Engineering Representatives used to do safety analysis work at Airplane manufactures in a completely parallel, firewalled cross-cutting engineering group that effectively reported directly to the FAA in a quasi on-loan model, “in order to reduce costs” the FAA allowed this to be scrapped and replaced with “Airworthiness Representatives” embedded in, and crucially answering to, the regular engineering management at the company. Company management then acts as middle-man to the FAA. AR Management at say Boeing is nominally supposed to act as independent of Boeing and represent FAA opinions, but in practice routinely pushes back on FAA requests and acts to represent the interests of Boeing management: https://www.seattletimes.com/business/delegating-aircraft-sa...
So previously if day-to-day engineering was under pressure from a manager to ship a software subsystem or complete a component design, these deadlines were unrelated to the DERs, who operated in their own safety-focused management chain under the FAA.
Now, the AR is under the same manager and pressures as everyone else to hit the ship date. It is unsurprising that quality of analysis might take a back seat to job security in such a setup.
It does not make much sense to defend the FAA by pointing at successes produced by processes that were no longer in place by the time the 737 MAX engineering programme began.
I think it was not the FAA's fault but rather the fault of the shrinking budgets and deregulation in parts that offload the safety checks to the manufacturer. blame congress over the past 20 years or so. the greed of boeing to shoehorn the MCAS into the aging airframe is the issue. they didn't want to have to get a new type rating and wanted to prevent needing to retrain pilots.
I think that would be unfortunate. I don't think it should die over this. The issues are eminently fixable. But a number of executives may have to exit Boeing, and the FAA, in order for the plane to not die, and all the issues must be fixed of course.
Not really. I am no expert, that is why I no longer trust FAA/Boeing telling me it is safe any more, at least in
this particular case. As a passenger, I would avoid buying tickets from this plane even it means more cost
What about it isn't fixable? Redundant (and thus more reliable) AOA sensors + a less aggressive MCAS system that at maximum displacement can't override the yoke would be more than enough of a fix for me.
In the event that MCAS is disabled, the pilots will have to work harder to notice impending stalls and prevent them. Which is why this requires training.
It's disabled with wings in departure configuration though isn't it? Isn't a scenario likely (i.e. another 10E-5) where a stall happens right on takeoff, say because of updraft or pilot error (although without training on this plane it would be hard to even call it that).
No need to make MCAS less aggressive. Training + an alarm should be sufficient. Even now, with no other changes at all, training might well be sufficient, though I'd much rather they make the system more robust and add an alarm.
No training in the world will help if this system malfunctions and puts the nose down at 1000ft already. You can't react fast enough to not hit the ground.
Also I don't want to fly in a plane where 'trained' pilots have to fearfully watched every feet they climb to quickly overturn a system that malfunctions.
> Boeing hasn’t announced what the second software problem is.
LNA is told it is the interface between the MCAS upgrade and the Flight Control System, but specifics are lacking.
> LNA interprets these combined events as indicative the MAX will be ground well past the Paris Air Show in June.
I had a heck of a time parsing that. I kept trying to read the "grounding" as something related to electrical grounding, wondering what "long grounding" was in that context and how Boeing had screwed it up
I remember reading that the MCAS system uses the exact same physical contacts as the pilot's electrical trim adjustment switches.
I'm wondering if they're trying to change their software implementation to more cleanly separate the two abstractions in the code in order to avoid having to do a hardware or firmware change on the jackscrew motor controllers.
If before, the signalling was such that the signalling was handled as a sort of one off block jammed into some function somewhere, they may now have to be doing much more thorough refactoring to separate out those interfaces, and improve the traceability, testability, and readability, all with the overhead of a system likely reclassified to "catastrophic" system hazard rating.
Either way, after some number crunching of my own, I can only see going forward with MCAS reasonable if there is some way to discretely disable its' ability to signal the jackscrew motor while leaving the electronic trim available in case of erroneous MCAS activation in the future, because with the requisite torque involved to quickly actuate that control surface against potential overspeed loads exacerbated by elevator up pitch commands, you'd need the electric motors, period.
Without taking into account friction, and using the stabilizer dimensions of the 737-800, in air conditions approximate to Addis Ababa, at 350 knots, discluding extra load from elevator up, and assuming an M24 jackscrew thread, it would have taken 357 ft-lbs torque to actuate against that wind load.
That's the output of a non-trivial automotive engine to bring that down to something the non-mathematically inclined can recognize, and while theoretically may be possible to gear for from a hand crank, I'm not confident I'm going to be able to figure out a gear train that can gear reduce enough to allow anywhere near enough speed when rotated by one pilot to get that horizontal stabilizer where it needs to be in so short a length of time.
Either way, I foresee a lot of chaos, and scrutiny moving forward in the handling of this, and can only hope we can finally come to terms as a nation with why certain regulatory agencies are worth the cost of investing in if only to keep the seeds of such tragedies as happened here from ever being able to germinate again.
The 737MAX was designed to compete with A320NEO .. why Did Boeing have to move the engines forward while Airbus did not ? AFAIK the NEOs weren’t a complete redesign either
The 737 rides significantly lower. Check out the 737-700/800/900 series and you’ll notice the engine cowl (inlet) is not perfectly round at bottom because of ground clearance. This is likely a design choice leftover from the original 737 series that used JT8D engines which are turbojet engines rather than high bypass turbo fans that make modern airliners efficient. Because Boeing has been so set on retaining the original type certificate they’re restricted in how much they can change the airframe. The only way to slap bigger more efficient high bypass turbo fans was to move them forward and up.
I apologize if this is too soon to ask this question, or if it comes across as crass given that 346 people are dead because of this failure.
What kind of long term implications could this have for the Aerospace industry in the US? Will we see some fundamental changes in safety oversight, or design, for these aircraft? Is this a "back to the drawing-board" moment for Boeing and the 737?
Would you still fly with Boeing Max after all this? I understand that the "issue" can be fixed with software but it looks like a hardware/design issue in the first place.
If your highest priority is safety the software should be used only when the hardware fails not to support a flawed design.
That's an irrational position. After the Ethiopian Airlines initial report was released pilots were discussing refusing to fly them even for ferry flights (i.e. no passengers).
The Ethiopian airlines crew followed Boeing's post-Lion Air safety bulletin and still crashed. There's no safe way to operate a 737 Max in its current state. The hypothetical recovery techniques (e.g. point nose down to release pressure on the horizontal stabilizer) only work at high altitude, which is notable if Ethiopian airline's AOA sensor was damaged by a bird strike right after take-off.
Nobody who understands the current state of this investigation should be saying they'd be comfortable on a 737 Max without changes. The "pilot training" narrative isn't just dead, but dead, buried, with a tomb stone.
Sure, pilots should have received training on MCAS existing, but MCAS was commanding trim changes that aren't easily recoverable under any circumstances and certainly not if you follow procedure and disable electronic trim. Nobody should fly on the 737 Max until an update completed, I'd go so far as to suggest that the US/EU should ban ferry flights.
> The hypothetical recovery techniques (e.g. point nose down to release pressure on the horizontal stabilizer) only work at high altitude
That's not quite right. Manually operating the motorized trim as soon as unwanted nose-down trim is detected prior to disabling it with the cutout switches appears to be a viable means of recovery. It's also an undocumented, timing-sensitive procedure in a critical phase of flight, which is not anything resembling what airline pilots want from their planes.
> Manually operating the motorized trim as soon as unwanted nose-down trim is detected prior to disabling it with the cutout switches appears to be a viable means of recovery.
That's what the Lion Air crew did. They died. The Ethiopian Airlines crew followed Boeing's safety bulletin. They also died.
But I do take your point, which may prove to be correct. It is hypothetically possible to electronically trim against MCAS then immediately cut out the electronic trim system before MCAS has a chance to re-initiate (5 secs after last trim command). Then you mechanically trim for the remainder of the flight, which should be possible without too much pressure on the horizontal stabilizer.
It is crazy to think that that may ultimately be the life saving procedure here, given its complexity/nuance. Particularly for a largely undocumented (for flight crew) system.
The information I'm aware of so far is that the Lion Air flight crew did repeatedly attempt to adjust the trim, but it's not known if they used the cutout switches. A previous flight with the same aircraft did experience runaway trim,and the cutouts were used before the problem became unrecoverable.
I find the design of this system shockingly ill-considered. At the very least, it should require input from both sensors and not activate if the sensors disagree. It seems to me a better system would be to automatically add some nose-down trim if the pilot applies full forward pressure on the stick since the primary underlying concern is insufficient elevator authority in certain impending stall conditions for that standard pilot response to be effective.
Flying at all, given currently unfolding climate catastrophe, does reflect tolerance (or even disregard) for putting life at risk. Actually this change in the risk appetite of the average future air travelers might have impact on how safety is emphasized in the future.
Sure, assuming it's just MCAS. The B737 program has had previous problems most notably uncommanded rudder movement that caused two US crashes in the 1990s with loss of all on board. [1]
From what's visible so far in the investigations Boeing (a) botched the MCAS implementation and (b) failed to train pilots on differences between the Max and previous models. Cure those two and the problem seems to be solved.
As far as I understand without MCAS software the aircraft is impossible to fly manually. I'm not sure I'm comfortable with that. Like turning off self driving just to find out that the car still changes direction by itself to compensate for a twisted wheel.
> As far as I understand without MCAS software the aircraft is impossible to fly manually.
Why does anyone think this? The MCAS system rarely engages.
The issue is simply to make the stick behavior similar to the older 737s at high AoA. For an older 737, when you're pitching way up, you really have to pull on the yoke to keep that high AoA. The plane naturally wants to return to a neutral AoA, so you have to fight it. With the new design, the engine position keeps the plane from wanting to return to the neutral AoA, at least to the degree it did before. Hence, the 'stick feel' at high AoA is lighter. You don't get the same tactile feedback about being near a stall. (you still have the stick shaker)
The MCAS is simply there to bring back that resistance to extreme AoA, and thus make it less likely to accidentally stall. MCAS isn't even active with flaps down (i.e. around takeoff and landing) so can't possibly affect those aspects of flight.
It's a questionable design for a number of reasons, but it's not at all necessary for flight, let alone 'basically impossible' without it.
I think the point is more you have to go all the way to manual trim to disable MCAS.
For Lion Air, the pilots didnt run (or even recall) the checklist so didn't disable MCAS.
However Ethiopian appears much worse, pilots did run the checklist, had some success with MCAS turned off but couldn't operate the manual trim (unclear why). They then made the fatal decision to turn back on electric trim (and MCAS with it) and MCAS almost immediately nosed them down into an unrecoverable state.
This doesn't go far enough. As reported by Al Jazeera in 2010, critical structural elements of the 737 NG that were supposed to be CNC'ed were handmade and grossly out-of-spec, leading to at least three deaths when 737 NG's broke apart in several sections on runway overruns, while in the past airframes held together intact in such events, protecting passengers. Boeing then covered up and scuttled its own investigation panel after management didn't like its conclusions.
tl;dr: 737 NG and MAX aircraft are fundamentally unsafe because of systemic lapses in regulatory oversight. These aircraft cannot be made safe economically due to Boeing's regulatory capture of the FAA, so it's best to never fly on them.
In my mind, Boeing as a passenger transport company is, or should be, finished. How they acted regarding the 737 NG and MAX are criminally-unforgivable.
I think there's a non-zero chance that the 737 MAX is going to end up with a type certificate. MCAS causes the MAX to behave differently than an NG, whether it's working as designed or not. And also that it can be disabled, immediately means the airplane isn't airworthy as certified and without a type rating the pilot isn't either.
Before this article I would have said, approaches zero chance a type certificate would be required. But the idea it would take 6-8 months to get it flying again? That's so outside the realm of what I was expecting that there must be some talk about it.
163 comments
[ 3.5 ms ] story [ 222 ms ] threadhttps://www.npr.org/2019/04/05/710477435/boeing-to-slow-prod...
> had a common link of a malfunctioning flight-control software called MCAS.
My understanding is the software was fine, it was faulty sensors with no redundancy and poor feedback displays to pilots.
And who is managing one sensor only or not providing the feedback? The MCAS software
The software is quite flawed (and operates differently than how it was described to the FAA) but there are two (thus redundant) sensors being used in a not-so-redundant manner.
The 737 Max could become the Edsel of airplanes.
https://en.wikipedia.org/wiki/Edsel
If they don't both give the same reading, MCAS turns off.
There’s no problem if one fails but what if both fail and both corroborate a bad reading?
Certainly the cost of 3 such sensors would not be as high as the cost of another crash.
This is why the parent poster is arguing for 3 sensors (and the real reason for tripling). If not all sensors agree but 2/3 do, it is more probable that the two sensors are correct than the 1 sensor disagreeing.
MCAS being automatically disabled when the sensors agree but leaving the pilots with electronic trim control seems like a perfectly adequate solution. The MCAS system was never even necessary for flight, it was only necessary for certification. In the situations where it's meant to be active, which are a limited subset of all high angle of attack scenarios, it's fine system to have if it's working correctly. But it should never be active outside of that limited set of scenarios. It should never be active when both angle of attack sensors aren't indicating a high angle of attack within a reasonable distance of each other.
Frankly, if two sensors are indicating a high angle of attack and one is not, it's probably still sensible to disable MCAS. I don't have any of the real numbers, but the chance of a 737 being in a low speed high angle of attack scenario is low in the first place, possibly sufficiently low that "two sensors being wrong and the aircraft being in level flight" might be more likely than "aircraft is near stall and one sensor is wrong."
To know for sure we'd need at least the hard data on what modes of failure these sensors have, how likely any of those modes is to occur and what the expected readouts from those failure modes are, and how likely a 737 is to encounter a low speed stall scenario. We, or at least I, don't have any of that. But my gut says that two sensors are sufficient iff the MCAS system is only active when they agree.
Furthermore, the chance of two sensors being wrong actually goes up if you have three sensors, rather than two. Correct me if I'm wrong, stats was never my strong point, but it seems to me like the cumulative binomial distribution is relevant here:
Chance of a single sensor failing, if each has a 1% chance of failure (sanity check): Chance of two or three out of three sensors failing, if each has a 1% chance of failure: Chance of two out of two sensors failing, if each has a 15 chance of failure: Two out of three sensors failing is three times more likely than two out of two sensors failing!(In other words, two broken sensors voting out a third working sensor is more likely than two out of two sensors being broken.)
Because as soon as one sensor fails that aircraft will go in for maintenance.
MCAS should turn off as soon as a single sensor fails, and three sensors are therefore unnecessary. Two sensors are sufficient to detect when a single sensor fails. If you only have two sensors and two fail, then MCAS remains active and your plane crashes. But that's not likely to happen. However that's more likely to happen if you have three sensors and try to use two sensors to vote out a third, in order to keep MCAS active when a sensor fails. In that configuration, a double failure (causing a crash) is three times more likely.
My conclusion is turn off MCAS as soon as even one sensor disagrees with the others. And if that's how MCAS is configured, then three sensors is unnecessary overkill. If you want overkill, you may as well double up the sensors on both sides and have four instead of three; all the better right?
I understand that's not what you mean, that the sensor indicating a situation closes to nominal flight should be chosen, but I think the sticky part is that MCAS isn't a system meant for normal flight conditions. MCAS is only supposed to be active when the aircraft is in an extreme scenario. So in fact if the sensor with "less-extreme adjustment" is preferred, in a way that actually means the system functions as I suggested: MCAS is disabled if the sensors disagree. But not quite. In your scheme if both the sensors are extreme but disagree, MCAS would be active to the lesser extent. But in my scheme, if both sensors are extreme but disagree, MCAS would be totally inactive (while leaving the pilot with electronic stabilizer trim control of course, allowing the pilot to manually do anything MCAS would be capable of doing.)
If I understood correctly, MCAS trimmed it so much that the pilots were unable to bring it back manually.
This sounds like Boeing engineers didn’t even put a limit on the maximum trimming that MCAS can do, not even to the maximum theoretical limit for the plane/engines.
Not only that, MCAS controlled an electric motor which turned the trim wheel and which could apply more torque than a human turning it manually. The only way to disable MCAS was to cut power to that motor. MCAS pointed the aircraft at the ground, and it was impossible to trim the aircraft to achieve level flight again.
Mind, MCAS was supposed to be a crutch to fly at the edges of the flight envelope, something that a regular pilot would never encounter because under normal conditions pilots wouldn't find themselves in a regime where MCAS would be activated. That was the idea, instead we had two hull losses within 6 months!
The issue from the Ethiopian crash was that, in the extreme trim angle, there was simply too much force on the screw to turn manually. This condition is trained for, and the solution is to let the plan angle down to relieve the aerodynamic pressure on the control surface. That gives you an opportunity to manually control the trim wheels.
The pilots did not have the benefit of altitude to perform this maneuver, so (likely) instead re-enabled the electric trim in a bid to use it to reduce the nose-down trim before the MCAS would re-engage. This proved fatal.
Scroll down slightly for the empennage diagram, right hand side, item 3.
https://www.seattletimes.com/business/boeing-aerospace/boein...
I also doubt customers will really vote with their feet given that the number one factor when booking a ticket is price. If some people choose not to fly on them it will create supply/demand imbalances in the market which would be interesting.
Agreed. As the article points out:
"Passengers eventually returned to flying the 787 and to other airplanes that were grounded: the McDonnell Douglas DC-10, the Douglas DC-6, the Lockheed Constellation and even the de Havilland Comet."
If Boeing really needed to cut these corners in order to remain competitive, then having to redo those corners might make them too expensive or inefficient for the market.
This is not my domain, but it reminds me of financial fraud, accountability of those at the top, and the consequences they face.
I was studied accounting in the wake of the major accounting scandals of the late 90's/early 00's. The Sarbanes-Oxley legislation was passed. It states that the CEO and CFO are directly responsible for their company's financial statements.
AIG was the first major accounting fraud post Sarbanes-Oxley. Investigated by the SEC, determined non-criminal, CEO stepped down, and that was his consequence. [1]
Boeing's CEO, Dennis Muilenberg, has the blood of 346 people on his hands. He is at the top, it is his organization, and his responsibility. I hope an investigation determines if it is criminal.
I think one of the major shifts I would like to see in our society is holding those in power to account. Whether it's accounting, aviation, banking, it doesn't matter. As it stands those at the top rarely pay for their malfeasance.
[1] https://vc.bridgew.edu/cgi/viewcontent.cgi?article=1145&cont...
If it's the same general setup as on the medical side with the FDA, then it's a virtual certainty that liability will fall with some compliance and QA types, as well as any engineers or engineering managers who signed the relevant documents. Those signatures are all legally binding, and represent to everyone up the chain that the systems in question are functioning properly. If the government can show that the systems in question could not have been functioning properly, they got you. (Another thing we learned from our lawyers about the FDA side, each document that you signed, represents one count of lying to the federal government at a minimum. Multiply that by the number of documents signed to get a single system through, and you get an idea of why you should never sign anything if you have any reservations at ALL. No matter how slight the reservation. No matter how much pressure the higher ups put on you. I think the rules are the same on the FAA side. So these guys have really stepped in it.)
That said, they may be able to snag a few executives here or there, but only if they can prove who knew what, and when. Execs, you would think, would be pretty careful about liability type things, so they could look very hard and not find anything on any of the execs. It would not be collusion or preferential treatment, it's just hard to find that kind of a smoking gun in a mountain of electronic documents and messages. (I strongly suspect that if the government were to press hard enough though, that some of the engineering managers and compliance types would turn state's evidence to get lighter sentences. At that point, you could probably get some execs I'd imagine? Still might be hard though.)
The engineers and QA/Compliance folks, though, should really be consulting with outside counsel. Just as a precautionary measure. I wouldn't trust Boeing execs to not throw me under the bus.
And this time around, it looks like a pretty big bus. I don't think you survive this hit.
Certainly not the FAA who delegated their oversight to Boeing.
346 people died because of their ineptitude.
So, no they where not operated in the same fashion. It’s still been grounded in the US for good reasons, but you can’t take individual regulations in isolation.
Even larger, well-resourced geopolitical entities like the EU rely heavily on the FAA to do its job for Boeing aircraft, much as the FAA relies on the EASA to do its job for Airbus aircraft. It's not pure rubber stamping, but it's close enough that things like this can pretty easily happen if a manufacturer's home agency falls asleep at the switch.
An example of the FAA's influence: Airworthiness regulations are so closely coordinated that special numbering is used by Canada, Europe, and Japan to match the numbering of FAA airworthiness regulations for easy cross-referencing. The FAA is also delegated air traffic control responsibility for much of the world's international airspace by the ICAO.
It is basically impossible to fly a commercial aircraft on Earth without being under the – possibly very heavy – influence of US civil aviation authorities, and it would take a great many resources and serious, concerted political will by many countries to change that.
The FAA has bilateral agreements with other countries and the EU for certification[1]. I read recently but can't quickly find in this that the FAA trusts EASA's certs for Airbus flying in the US.
The Ethiopian agency also trusts the FAA and EASA for this information[2]
So, it's not really tricky here, we can blame the FAA for the crash of a US manufactured plane in a foreign land (if the problem was the FAA's certification process).
[1] - https://www.faa.gov/aircraft/air_cert/international/bilatera...
[2] - https://web.archive.org/web/20180215175924/http://www.ecaa.g...
So, EASA can’t really abandon blame as easily as they abandon responsibility. If they allow a flawed process to continue then that’s on them.
However, in this case these agreements still give EASA veto authority about what aircraft are allowed. Which is why EASA was able to ground these airplanes before the FAA did.
https://www.caranddriver.com/features/a15125313/its-all-your...
Then again, I still wouldn't be surprised if most people were just too perplexed if their car suddenly accelerated like crazy and not stay calm and hit the brakes as hard as possible right away. It might take you a second or two to get what's going on, and by then you might already have lost control.
I stood on the brakes and didn't let up. He reached over and shut off the key, which locked the steering and put us in the ditch, but at relatively low speed due to the continuous braking.
Very new cars with an entirely radio-based "key" might behave something like that.
Without electronics or software involved, many years ago (1980's or so) there was a FIAT diesel engine, that was widely used on mid-sized cars, typically the Ritmo (Strada in the US) that had a servo-brake working by depression coming from the engine that had a defective membrane.
Basically, it could happen that the membrane broke/got a hole in it and the oil from the engine would enter the combustion chamber, to the effect that the engine would go up at full revs.
And you couldn't switch it off, the only way was to depress the clutch pedal, put in fourth or fifth gear and brake hard while releasing quickly the clutch.
It was a terrifying experience for someone not very familiar with cars/engines, though most people using a manual gearbox know that by depressing the clutch and braking would stop the car (so no or few accidents caused by this issue), knowing how to forcibly turn off the engine wasn't (and still is not) common knowledge, the motor would continue going on for a few minutes until something else would break or the oil in the engine would have been mostly burned (leaving the engine with no lubrication at full revs) until the engine would seize up.
Are you saying the additional, let’s say, what?, 60kW of power being applied to the wheels will require no additional effort at the brake pedal to overcome.
Colour me unconvinced.
I’ve never tried to imitate a burnout at 70mph / I’m not convinced the circumstances are the same.
>And despite dramatic horsepower increases since C/D’s 1987 unintended-acceleration test of an Audi 5000, brakes by and large can still overpower and rein in an engine roaring under full throttle. With the Camry’s throttle pinned while going 70 mph, the brakes easily overcame all 268 horsepower straining against them and stopped the car in 190 feet—that’s a foot shorter than the performance of a Ford Taurus without any gas-pedal problems and just 16 feet longer than with the Camry’s throttle closed.
From https://www.caranddriver.com/features/a16576573/how-to-deal-...
The result of Toyota's firmware audits were terrifying [1], and I think it's still reasonable to be concerned about potential issues here. If the brake-by-wire system were to have firmware issues, your point would be moot.
The thought that Boeing probably needs a similar audit to shine light on some dark corners and encourage them to clean up their act also seems quite reasonable.
[1] https://users.ece.cmu.edu/~koopman/pubs/koopman14_toyota_ua_...
As another sign of this, Toyota both stonewalled the investigation and later fired the director of the division in charge of ECU engineering, and rebuilt the division.
>cannot be ruled out
That seems like a very weak statement. If you asked a software auditing firm to inspect your massive codebase they're not going to "rule out" any bugs either.
It's not about software verification. In this case, the verifier would have given it a pass (with respect to this particular accident).
It's about bad management/bad requirements:
- "minimization of pilot training is the overarching requirement"
- "it's okay to feed only a single sensor into MCAS, even though there are two of them on the plane"
- "it's okay to sell critical safety equipment as options costing extra"
- "it's okay to not tell any pilot about any of this, since we practically didn't change anything".
This particular one is not about C++.
I'm coming down on the side of the cause of these accidents was due to the failure to properly type certify the aircraft. Because they were trying to avoid that they failed to do the system analysis and testing including simulator testing that would have easily found this.
This might be too hot of a take for HackerNews, but... look at how many people the FAA has kept safe over the past 30 years. I'm pretty sure the number of people who travel without dying is very, very high. I don't disagree that their might have been some ineptitude (I'm sure you could find that anywhere for anything since it's opinion driven), but to say the FAA is all rotten because 346 died is kind of dramatic when millions have been kept safe.
It's incredibly dangerous to propose changes to the FAA, given how much of an unqualified success they've had over the years at keeping flight safe. Don't let y our populist rage kill probably one of the best/most successful government institutions the US has ever created.
That is an incredibly ironic thing to say, because these deaths are a result of changes to the FAA, specifically, the delegation of the FAA's regulatory authority to the company being regulated. That this would not end well was easily foreseeable because it's such a blatant conflict of interest.
I was using the word in this sense:
"Irony: a literary technique, originally used in Greek tragedy, by which the full significance of a character's words or actions are clear to the audience or reader although unknown to the character."
Your fake choice of definition is even worse than what you actually meant.
It's somewhat abstract, but it's an interesting question to me, which is why I asked. Does the FAA's authority to regulate aircraft construction come from Congress specifically delegating authority over aircraft construction to them- or does the FAA only effectively have the ability to control construction because they can prevent the aircraft from flying in US airspace?
FAA's reputation alone was good enough for other aviation authorities to accept its certification of Boeing's MAX 8, which is why the FAA matter despite happening way outside its jurisdiction.
And yes the numbers are not the only relevant issue. It is the manner in which the original certification was done, the failure to act swiftly after the first crash, and the inordinate delay in acting even after the second crash which together seem to paint the picture of an organization which puts the interest of the manufacturer above passenger safety.
That doesn’t sound like an argument anyone would intentionally make.
They’ve done good work, great. But these two incidents represent a fall from grace, and both organisations should be pilloried for that incompetence especially because they have a history of high standards.
http://sunnyday.mit.edu/
An important quote from her book "Engineering a Safer World" section "Questioning the Foundations of Traditional Safety Engineering":
"Old Assumption
- Major accidents occur from the chance simultaneous occurrence of random events.
New Assumption
- Systems will tend to migrate toward states of higher risk. Such migration is predictable and can be prevented by appropriate system design or detected during operations using leading indicators of increasing risk."
So it's: either the organizations are themselves able to keep the risk from increasing (as quoted, that is even "predictable" and of course it "can be prevented") or there have to be the external influences in that direction.
In this case, the organizations themselves failed.
Thus there is a discrepancy between your perspective / opinion and the typical way that the NTSB and FAA operate: this is precisely the time to address any issues.
The 737 MAX additionally has a tendency to pitch up when pitching up. The more you pitch the aircraft up, the more it wants to pitch up. As you pitch up more and more, you'd like the required force on the controls to increase, but in the 737 MAX it would naturally decrease.
In reality, major changes have been made to the way that the FAA operates and delegates authority in a series of sweeping changes since 2005 that were largely meant to cover for the fact that Congress has been severely underfunding the FAA.
The MAX is one of the first models we’ve seen wholly designed and manufactured under this new process. (substantial amounts of the underlying safety analysis of the 787 happened under the old setup)
One major change that may be relevant in this case is that whereas Designated Engineering Representatives used to do safety analysis work at Airplane manufactures in a completely parallel, firewalled cross-cutting engineering group that effectively reported directly to the FAA in a quasi on-loan model, “in order to reduce costs” the FAA allowed this to be scrapped and replaced with “Airworthiness Representatives” embedded in, and crucially answering to, the regular engineering management at the company. Company management then acts as middle-man to the FAA. AR Management at say Boeing is nominally supposed to act as independent of Boeing and represent FAA opinions, but in practice routinely pushes back on FAA requests and acts to represent the interests of Boeing management: https://www.seattletimes.com/business/delegating-aircraft-sa...
So previously if day-to-day engineering was under pressure from a manager to ship a software subsystem or complete a component design, these deadlines were unrelated to the DERs, who operated in their own safety-focused management chain under the FAA.
Now, the AR is under the same manager and pressures as everyone else to hit the ship date. It is unsurprising that quality of analysis might take a back seat to job security in such a setup.
It does not make much sense to defend the FAA by pointing at successes produced by processes that were no longer in place by the time the 737 MAX engineering programme began.
Somewhat poor choice by the writer here given the association.
Not really. I am no expert, that is why I no longer trust FAA/Boeing telling me it is safe any more, at least in this particular case. As a passenger, I would avoid buying tickets from this plane even it means more cost
Also I don't want to fly in a plane where 'trained' pilots have to fearfully watched every feet they climb to quickly overturn a system that malfunctions.
* Manual MCAS cut-out switch that leaves the electronic trim available, without resorting to "hacks" like using the flaps.
* AoA disagree warning option on all planes, maybe even auto-cut out MCAS when disagree happens.
* Simulator training for all pilots on all MCAS failure scenarios and flying without MCAS.
> Boeing hasn’t announced what the second software problem is. LNA is told it is the interface between the MCAS upgrade and the Flight Control System, but specifics are lacking.
> LNA interprets these combined events as indicative the MAX will be ground well past the Paris Air Show in June.
I had a heck of a time parsing that. I kept trying to read the "grounding" as something related to electrical grounding, wondering what "long grounding" was in that context and how Boeing had screwed it up
I remember reading that the MCAS system uses the exact same physical contacts as the pilot's electrical trim adjustment switches.
I'm wondering if they're trying to change their software implementation to more cleanly separate the two abstractions in the code in order to avoid having to do a hardware or firmware change on the jackscrew motor controllers.
If before, the signalling was such that the signalling was handled as a sort of one off block jammed into some function somewhere, they may now have to be doing much more thorough refactoring to separate out those interfaces, and improve the traceability, testability, and readability, all with the overhead of a system likely reclassified to "catastrophic" system hazard rating.
Either way, after some number crunching of my own, I can only see going forward with MCAS reasonable if there is some way to discretely disable its' ability to signal the jackscrew motor while leaving the electronic trim available in case of erroneous MCAS activation in the future, because with the requisite torque involved to quickly actuate that control surface against potential overspeed loads exacerbated by elevator up pitch commands, you'd need the electric motors, period.
Without taking into account friction, and using the stabilizer dimensions of the 737-800, in air conditions approximate to Addis Ababa, at 350 knots, discluding extra load from elevator up, and assuming an M24 jackscrew thread, it would have taken 357 ft-lbs torque to actuate against that wind load.
That's the output of a non-trivial automotive engine to bring that down to something the non-mathematically inclined can recognize, and while theoretically may be possible to gear for from a hand crank, I'm not confident I'm going to be able to figure out a gear train that can gear reduce enough to allow anywhere near enough speed when rotated by one pilot to get that horizontal stabilizer where it needs to be in so short a length of time.
Either way, I foresee a lot of chaos, and scrutiny moving forward in the handling of this, and can only hope we can finally come to terms as a nation with why certain regulatory agencies are worth the cost of investing in if only to keep the seeds of such tragedies as happened here from ever being able to germinate again.
What kind of long term implications could this have for the Aerospace industry in the US? Will we see some fundamental changes in safety oversight, or design, for these aircraft? Is this a "back to the drawing-board" moment for Boeing and the 737?
The Ethiopian airlines crew followed Boeing's post-Lion Air safety bulletin and still crashed. There's no safe way to operate a 737 Max in its current state. The hypothetical recovery techniques (e.g. point nose down to release pressure on the horizontal stabilizer) only work at high altitude, which is notable if Ethiopian airline's AOA sensor was damaged by a bird strike right after take-off.
Nobody who understands the current state of this investigation should be saying they'd be comfortable on a 737 Max without changes. The "pilot training" narrative isn't just dead, but dead, buried, with a tomb stone.
Sure, pilots should have received training on MCAS existing, but MCAS was commanding trim changes that aren't easily recoverable under any circumstances and certainly not if you follow procedure and disable electronic trim. Nobody should fly on the 737 Max until an update completed, I'd go so far as to suggest that the US/EU should ban ferry flights.
That's not quite right. Manually operating the motorized trim as soon as unwanted nose-down trim is detected prior to disabling it with the cutout switches appears to be a viable means of recovery. It's also an undocumented, timing-sensitive procedure in a critical phase of flight, which is not anything resembling what airline pilots want from their planes.
That's what the Lion Air crew did. They died. The Ethiopian Airlines crew followed Boeing's safety bulletin. They also died.
But I do take your point, which may prove to be correct. It is hypothetically possible to electronically trim against MCAS then immediately cut out the electronic trim system before MCAS has a chance to re-initiate (5 secs after last trim command). Then you mechanically trim for the remainder of the flight, which should be possible without too much pressure on the horizontal stabilizer.
It is crazy to think that that may ultimately be the life saving procedure here, given its complexity/nuance. Particularly for a largely undocumented (for flight crew) system.
I find the design of this system shockingly ill-considered. At the very least, it should require input from both sensors and not activate if the sensors disagree. It seems to me a better system would be to automatically add some nose-down trim if the pilot applies full forward pressure on the stick since the primary underlying concern is insufficient elevator authority in certain impending stall conditions for that standard pilot response to be effective.
From what's visible so far in the investigations Boeing (a) botched the MCAS implementation and (b) failed to train pilots on differences between the Max and previous models. Cure those two and the problem seems to be solved.
[1] https://en.wikipedia.org/wiki/Boeing_737_rudder_issues
Why does anyone think this? The MCAS system rarely engages.
The issue is simply to make the stick behavior similar to the older 737s at high AoA. For an older 737, when you're pitching way up, you really have to pull on the yoke to keep that high AoA. The plane naturally wants to return to a neutral AoA, so you have to fight it. With the new design, the engine position keeps the plane from wanting to return to the neutral AoA, at least to the degree it did before. Hence, the 'stick feel' at high AoA is lighter. You don't get the same tactile feedback about being near a stall. (you still have the stick shaker)
The MCAS is simply there to bring back that resistance to extreme AoA, and thus make it less likely to accidentally stall. MCAS isn't even active with flaps down (i.e. around takeoff and landing) so can't possibly affect those aspects of flight.
It's a questionable design for a number of reasons, but it's not at all necessary for flight, let alone 'basically impossible' without it.
For Lion Air, the pilots didnt run (or even recall) the checklist so didn't disable MCAS.
However Ethiopian appears much worse, pilots did run the checklist, had some success with MCAS turned off but couldn't operate the manual trim (unclear why). They then made the fatal decision to turn back on electric trim (and MCAS with it) and MCAS almost immediately nosed them down into an unrecoverable state.
tl;dr: 737 NG and MAX aircraft are fundamentally unsafe because of systemic lapses in regulatory oversight. These aircraft cannot be made safe economically due to Boeing's regulatory capture of the FAA, so it's best to never fly on them.
In my mind, Boeing as a passenger transport company is, or should be, finished. How they acted regarding the 737 NG and MAX are criminally-unforgivable.
Before this article I would have said, approaches zero chance a type certificate would be required. But the idea it would take 6-8 months to get it flying again? That's so outside the realm of what I was expecting that there must be some talk about it.