> When upgrading the cockpit with a digital display, he said, his team wanted to redesign the layout of information to give pilots more data that were easier to read. But that might have required new pilot training. So instead, they simply recreated the decades-old gauges on the screen.
That seems very sane? It's a more fuel-efficient 737; carriers and pilots want and need redesigned cockpit and instruments as much as I need the latest take of the Gmail design team on how a mail app should look and function.
The process and rationale for redesigning a web app to drive engagement is not really comparable to that of redesigning an aircraft instrument panel to promote safety.
I think this is a bad take - the reason why Gmail's redesign is bad is because the motivation is bad. They want more lock-in, more engagement etc. Stuff unrelated to being a good mail app. The reason the 737 redesign was good was because they actually could lay things out better and make things easier to use and safer. The reason not to redesign was bad - wanting an easy sell, and so the choice of not to redesign was bad, since you're not producing the best produce. Whether or not to redesign isn't the thing that sunk the 737 Max, but it is another manifestation of the same motivation that caused the problems.
That's about common type ratings. With the same cockpit, a pilot qualified to fly the 737 is qualified to fly anything in that common type rating. If the 737 MAX is similar enough to be in that common type rating, no specific training or certification is required. That's something Boeing wanted. Probably because the airlines wanted it.
It's not weird. Pilots get used to a particular 2D pattern of repeatedly and sequentially scanning the instruments in front of them. When flying a particular model of aircraft, safety requires those instruments to be in the same place without the pilot having to waste even a second looking for them.
But that's not what Boeing accomplished. Previous someone posted to HN about the 737 MAX entries in the ASRS reporting system. Among those reports were complaints that pilots couldn't find the gauges quickly and that they were taking much longer to scan the gauges because they were so different.
Something else that's worrying is this comment from a technician:
His internal assembly designs for the Max, he said, still include omissions today, like not specifying which tools to use to install a certain wire, a situation that could lead to a faulty connection. Normally such blueprints include intricate instructions.
I hope that all these failures are investigated and addressed before the plane is allowed to fly again.
I can't really see any decision point where an engineer might have stood up and said "this plane isn't safe," like Allan McDonald did with the Challenger. The article tries to hang blame on the decision not to upgrade the cockpit info displays, but there was nothing wrong with the old display systems. It's still not clear if the plane is actually aerodynamically flawed or if the MCAS was simply programmed poorly. Even the business decision was fine; from the perspective of a non-technical executive, "add newer engines but change as little else as possible" seems like a pretty reasonable directive and not likely to cause safety issues. Engineers could have complained about the pace of work but I think it was made clear to them that they were fighting for their jobs: Boeing has had numerous 10,000+ workers layoffs in the past. With everything we know now, I can't see any criminal charges being filed in relation with this disaster.
Yep, there’s going to be a lot of hand wringing, finger pointing and hot air expended over the next few years and this is basically it. Boeing had two options:
(1) 3 sensors plus majority voter.
(2) A mandatory AoA disagree indication plus some training on how to react to it.
They chose option (3): Neither. Frankly when I heard there were just two sensors and no disagree indication, my first thought was well that’s just as good as one sensor and hoping for the best, isn’t it? The “challenger moment” would have been after the meeting they decided on this.
It's more literally "just one sensor" than you say, I think. MCAS doesn't average or anything: it just picks one sensor at a time arbitrarily and uses it. (This will change in next month's software fix.)
(2) sounds like it could be airworthy, but I think Boeing might instead find that it has to add that third sensor. Airbus has three, and any rationale that Boeing only needs two because the disagreement consequences are not severe seems atop quicksand at this point.
That's what really amazes me. Especially since AoA vanes are known to be troublesome.[1] In most aircraft they just trigger the stall warning horn and stick shaker; they don't directly affect aircraft control.
My gut tells me aerospace errs on the side of simplicity and reproducibility. It could work, though ideally system errors wouldn’t interfere with other systems.
It is worth pointing out that an AOA sensor should not be critical for normal flight. If a sensor is faulty then why not simply stop using angle of attack as a data point. It should still be perfectly possible to fly safely and using a configuration that will avoid a stall. Pilots should be able to fly on a minimum set of instruments.
As a pilot myself, that doesn't strike me as disqualifying. The minor problem I have is that it has has no self-verification/disqualification mechanism; even in the face of having two sensors available! The far bigger problem I have is, the automation discounts pilot input as if it's the pilots who are wrong. That's obscene. And it strikes me as a violation of CRM.
I do not accept that pilots must have disabled auto trim in order to prove they are the more valid input source, compared to a single alpha vane sensor. That's perverse. Pilots have to flip switches to prove they are working correctly? Yet the sensors don't have to have self-verification/disqualification, or cross check with an available second sensor?
They could have also used inputs from other systems as a sanity check such as altitude, air speed, pilot input, etc. I'm really surprised the software didn't take any other available data into consideration.
The horizon indicator alone should serve as a check. If you (the computer) think the plane is about to stall, it makes sense to nose it down to compensate. Ok, cool. But if you think it's stalling, and you see that you're at a negative attitude, then it's much more likely that trimming the horizontal stab is a bad idea.
I'm sure there are other checks as well. Also not sure if I'm missing something with this armchair analysis.
I'm with you on that. It also seems completely against the Boeing ethos of when the auto pilot is off you should be hand flying the plane and your control inputs dictate the movement of the flight surfaces. That has been a perceived difference in philosophy between Boeing and Airbus. MCAS sounds like a hastly thrown together work around and a disaster waiting to happen.
I believe the Lion Air investigators have made public that there was a 20 degree differential between the two AoA sensors even when they were sitting on the runway before flight. (I don't have a source easily accessible.)
That's almost like saying two compasses should agree while standing on the north pole. These sensors need airflow to operate and provide meaningful indication.
Sure, but they maintained their twenty degree difference for the duration of the flight. That's why the one stick shaker started going off shortly after rotation, why autopilot wouldn't engage, and why MCAS was going nuts.
Why should an AoA sensor require airflow? And if we are talking about airflow, we are talking about measuring pressur differentialsm right? How to do calculate an angle using a pressure differential?
No, it's still obvious fail-deadly insanity. Having to say that the pilots would need to quickly notice issue is even worse (have you seen how you disable the system? It's not a button that you push).
The point of the plane variant was to not perform any additional training, too.
Anyone saying that to the engineers should be considered a criminal. There is probably a whole incentive structure that lead to this and that should be upended completely.
Not a good year this for Boeing, there has been major crashes of the 707 and 767 in the last 2 months, apart from the 737 Max loss.(Though 707 crash was due to lt landing in wrong airport by mistake, where the runway was not long enough, so it crashed into a wall).
It is interesting and a bit disconcerting to see how a question like this one for some quickly turns into the the same type of partisan quibble as an Android-vs-Apple or Emacs-vs-vi or Linux-vs-Windows question would. If there were ways to map answers onto a globe I expect the 'pro-Boeing' answers to mostly come from the north-American continent and the 'pro-Airbus' mostly from the Eurasian and south-American continent with more diverse answers from the other continents.
That is what makes it disconcerting to see the same clan-like attitude arise in this discussion. It is one thing to 'defend your team' when talking about mobile user interfaces, freedom of choice of where to get your applications from or the relative virtues of different software development models. In this case two crashes seem to be partly caused by design problems and as such it seems to be an inappropriate response to try to 'defend the team'.
This seems to be getting worse and worse for Boeing, and they definitely aren't acting like they understand the gravity of the situation. I guess Boeing has been coasting along based on its position and reputation for a few decades and this is the result.
That's not really accurate. Boeing is under continuous attack by hatchet jobs like this that insinuate they cut corners and are solely responsible for these accidents.
First, we don't have final reports from the investigators yet, so it's awfully early to point the finger.
Second, every major aviation accident is multi-factorial. It's never just one failure that causes it.
If it does turn out to be the faulty AOA indicator causing the electric trim to go nose-down, there are still a number of other obvious contributing factors in addition to the faulty sensor.
The public is demanding low airfare prices because they are getting squeezed by the increasing disparity of wealth worldwide. Wages are not rising as fast as prices, and as the cost of doing business with China slowly rises due to the trade war, prices start to creep up and the squeeze increases.
Airlines respond by flying pilots with lower time and lesser training, paying them less, and working them harder.
Pilots spend less time in the simulator working on abnormal conditions, and while they are undoubtedly great at monitoring normal flights and navigating controlled airspace, they have less experience hand-flying approaches and dealing with rare equipment failures and emergencies.
Every pilot should have adequate simulator time to be competent with every emergency procedure for which there is a checklist, but that is not the reality. The three seconds allotted by the FAA to diagnose critical systems failures is simply not enough if you can't find and execute the correct checklist in that time period.
In the old days, every single pilot from a Cessna 152 on up knew exactly what a badly trimmed airplane felt like and how to fix it instantly. When you felt that extra force on the controls, you would instinctively rotate the trim wheel in the direction of the force that you were needing to apply.
Same for electric trim systems: if the force doesn't ease the way it should, you have a runaway and you need to interrupt power to the electric trim system.
But that is hand-flying, stick-and-rudder-type stuff. If you're not getting the hand-flying time and the simulated failure time, you just don't develop that instinct.
It's not entirely Boeing's fault that an aircrew can't recognize and counter a runaway electric trim, no matter what the details in the flight manual. It's only reasonable to assume that basic level of competency.
All pilots of Boeing aircraft know that when the autopilot is off, there is no automation between the controls and the control surfaces - until the 737 Max changed that. The MCAS system is only active when autopilot was off, a big change. Imagine the faulty AoA sensor is causing the aircraft to hunt around to different altitudes. The pilot switches off autopilot by just applying force to the controls and suddenly the plane starts pitching down.
True, but a yaw dampener is sort of like a steady cam, it isn't going to over-rule a pilot's rudder input.
Put yourself in the seat of a pilot who has flown an electro-hydraulic 737 for years. Something "funny" seems to be going on with the trim, so you take control and the trim seems to be working perfectly while you manually toggle it, but then the MCAS kicks back in after 5 seconds and tries to push the nose down again. This kind of behavior is coming from a system Boeing did not tell the pilots about.
I cannot agree more. After the 1st crash you would think every pilot would have become familiar with this system and how to override it. The stuff that has come out from the most recent crash shows that the pilot was read through manuals trying to understand what was happening. Given the most recent crash, why would he not think, hey lets disable this new system because my plane is acting in the exact same way. I am not saying that Boeing is not at fault for poor training or documentation but if I was flying the same plane as one that recently crashed I know I would have known everything I could about that crash before I lifted off in that same model.
After the first crash Boeing should have pulled that plane out of service, period. It shouldn't be up to pilots to try to find workarounds for rotten engineering.
The first crash can be chalked up to engineering errors, corner cutting and the desire not having to retrain and recertify pilots.
The second crash is outright criminal by Boeing, for not immediately pulling that plane out of circulation after the Lion Air disaster. Regardless of the cost (which will be much, much more expensive after crash 2).
Their cozy relationship with the FAA also didn't help and I hope the people responsible pay dearly for that.
Throwing the pilots under the bus is how they tried to handle that PR desaster. Doesn't seem to work well, though.
You can however disable the MCAS and it is apparently well documented in the pilot training material. When the trimming wheel acts strangely this is a sign that something may be going wrong and this is part of what pilots need to know when flying this aircraft.
Now whether or not such information is widely known among all pilots is another matter altogether.
I agree with most of your points in general, but Boeing tried as hard as possible to pretend MCAS needed no training. There WAS no simulator scenario to train on for this failure.
Based on accurate descriptions of the intended scenario for MCAS, they would be right. When the system is working, it does what it was designed to do. The failure mode when an AOA sensor goes on the fritz is the problem. The proposed fix is what they should have shipped out with the first plane, that's the real failure here -- someone at Boeing surely saw this coming and raised a flag, and got shouted down. A reckless decision given that the 737 is a cash cow and historically such a successful line of planes that I imagine Boeing would be keen to keep the reputation intact.
Sort of with you, but I think once you're willing to admit that MCAS failure can be catastrophic, airworthiness regulations may require three AoA sensors (as Airbus planes have) so that you get error correction, rather than the two that should have been being used to detect disagreement (but weren't).
I think the issue is that Boeing didn't see a potential MCAS failure as really any different from any other cause of runaway trim, for which there was well-established procedure and training. Clearly at least not all pilots seem to recognize this in time, particularly with other distractions caused by a faulty AoA reading, such as stick shaker, other warnings and alarms, and all of that happening at low altitude.
I don't think that matters here, though I agree with what you said. There's also going to be redundancy on the other mechanisms that can lead to runaway trim, because runaway trim can be catastrophic, because we don't assume that pilots are perfect, and because (as you say) runaway trim can happen in situations where the ground will necessarily arrive before your recovery does.
I think it takes around thirty seconds for the trim motor to move you from one end (where both crashed planes had it) of the jackscrew to the other. And that's with the motor! If you cut out the motor because it was literally trying to kill you -- and as Boeing advises you to -- you'll have to use the hand crank and it will take much longer. Runaway trim at low altitude is death.
It really seems to me that the MAX as shipped was not plausibly airworthy (due to the use of a single sensor). I think even Boeing's going to agree eventually.
A "more right" solution would have been to implement a "stick pusher" system to make it obvious to the pilot what was going on. But that would have required pilot training and punctured the illusion that the plane can be flown by any pilot who has flown any 737 made since the 1960's
I have to preach the idea that networks and computing are not magic. While yes, I cam talk to people all over the world, the information I'm trying to communicate still has to be put in front of a person to be communicated.
An aircraft company should treat information dissemination to pilots as as critical a toolchain as their supply and manufacturing processes.
If your tool cannot be used safely, your job isn't done, no matter what your marketing people say.
If it were a financial services, or big data cpmpany maybe I'd lend credence to the safety of leaving that out.
Not aviation. There is too much at risk there. Flight is the equivalent of riding a bubble of air to your destination, which necessitates the continuous balancing of aerodynamic forces, facilitated by increasingly complex hybrid systems of direct human control and automation.
At the end of the day though, a pilot/plane combination should be able to be salvaged even with catastrophic loss of piloting aids, even with catastrophic loss of integrity of the automation on board.
Automation should make flying a plane easier. Not render pilots ineffective when it malfunctions or fails.
Well the maiden passenger flight of the A320 crashed at the Paris Air Show, and the pilot said the fly-by-wire system didn't let him pull up[1]. Officially it was pilot error though.
There have been nearly 1,400 fatalities with the A320, with some pilots blaming the fly-by-wire systems, but many of those happened before the age of Twitter and social media virality of this sort of thing so who knows what the public reaction would be today.
The A330 had some weird pitch down incidences due to a faulty ADIRS, and obviously AF447 due to faulty pitot tubes and the completely idiotic issue where the control sticks aren't synced and the inputs are averaged out before being sent to the plane. There were some considerations given to grounding the fleet, whether or not Airbus wanted to admit it at the time.
There are several pilots who've had this very issue happen to them and they managed to diagnose and address the problem without flying the plane into the ground.
These incidents are almost always the result of a combination of errors ranging from negligent engineering and documentation to mechanical defects to human (pilot) error. We simply don't know all the facts in these two crashes.
The publicly available information to me indicates negligent documentation (pilot manuals should have been updated to reflect the new mode and how to treat the issue similarly to runaway trim), negligent sales practice (the AoA disagree feature shouldn't be an option), and poor reactions by the pilots involved. But that's purely speculation at this point: there could very well be some other causes instead of or in addition to these.
Is that a serious question, or did you just not do any research? Yes, Airbus planes have crashed due to malfunctioning automation. It hasn't even been that long since one of their newest planes actually experienced a problem eerily similar to the 737MAX issue, but got lucky in that it occurred when the plane was higher and had more altitude to trade for time and the pilots were able to regain control.
> If it does turn out to be the faulty AOA indicator causing the electric trim to go nose-down, there are still a number of other obvious contributing factors in addition to the faulty sensor.
There's no serious argument here. It isn't airworthy on an airliner to have a system with flight control capability using one sensor with no redundancy. It doesn't happen anywhere else and there are regulations that forbid it. Airbus uses AoA for autopilot and therefore puts three AoA sensors on the plane with majority voting.
It appears that Boeing (during certification) either lied about the severity of MCAS failure, or lied and said they were using two sensors when they weren't.
I wonder if Boeing and their engineers instinctively knew it was their fault after the first crash, or at least had a feeling/intuition, and how many hoops they had to jump through to cover it up only for it to come up again
Boeing is still going to clean Airbus' clock with the 737MAX. This isn't the first time they've had something like this happen, soon enough people will forget and this plane will most likely go on to become yet another wildly successful 737 variant, safest in the world. Maybe they will downplay the MAX name, though, and market it simply as 737-7, 737-8, and 737-9 going forward.
The one that really stands out for Boeing is the 777. I fly a lot and liked Airbus for long flights more, but as airlines upgrade from A340 to the 777, it's always for the better. I would still take the 380 if available, though.
Yes, like McDonnell-Douglas renaming the later revisions of the DC-10 as the MD-11.
The MD-11 even included "a partly computer-driven horizontal stabilizer. Updates to the software package made the airplane's handling characteristics in manual flight similar to those of the DC-10" [1]
Sounds like Boeing might have dusted off an old MD idea.
I think you're probably right, they will improve the systems, improve the training, probably pay some sort of settlement, and as long as no smoking-gun evidence of deliberate malfeasance is found (ala Volkswagen Dieselgate), they will survive. Heck, Volkswagen survived, anyway.
Why? Both competitors have put new engines on old frames. Boeing has the MAX; Airbus has the A320neo. As far I can tell, the two planes are comparable.
Also, there's already a 737-700, 737-800, 737-900.
Also the A320 is fully fly-by-wire and has three alpha vanes so even if/when logic similar to MCAS was needed... it could be implemented in a safe and sane manner.
You have no choice. First the install base of old models is huge and actually quite safe. 777 hasn't had a single crash yet (I don't count the hull losses of Malaysian as crashes). 787 is amazing plane.
And airbus cannot ramp up production enough to fill the whole midrange single isle market.
So Boeings will be bought by airlines. Or the exopansions will be crippled and tickets will fly trough the roof.
> When upgrading the cockpit with a digital display, he said, his team wanted to redesign the layout of information to give pilots more data that were easier to read. But that might have required new pilot training. So instead, they simply recreated the decades-old gauges on the screen.
This was a particularly weird detail, I thought.
That seems very sane? It's a more fuel-efficient 737; carriers and pilots want and need redesigned cockpit and instruments as much as I need the latest take of the Gmail design team on how a mail app should look and function.
The process and rationale for redesigning a web app to drive engagement is not really comparable to that of redesigning an aircraft instrument panel to promote safety.
I think this is a bad take - the reason why Gmail's redesign is bad is because the motivation is bad. They want more lock-in, more engagement etc. Stuff unrelated to being a good mail app. The reason the 737 redesign was good was because they actually could lay things out better and make things easier to use and safer. The reason not to redesign was bad - wanting an easy sell, and so the choice of not to redesign was bad, since you're not producing the best produce. Whether or not to redesign isn't the thing that sunk the 737 Max, but it is another manifestation of the same motivation that caused the problems.
That's about common type ratings. With the same cockpit, a pilot qualified to fly the 737 is qualified to fly anything in that common type rating. If the 737 MAX is similar enough to be in that common type rating, no specific training or certification is required. That's something Boeing wanted. Probably because the airlines wanted it.
Well Boeing wanted it just as much. If you need to retrain all your pilots anyway, Airbus becomes much more competitive.
It's not weird. Pilots get used to a particular 2D pattern of repeatedly and sequentially scanning the instruments in front of them. When flying a particular model of aircraft, safety requires those instruments to be in the same place without the pilot having to waste even a second looking for them.
But that's not what Boeing accomplished. Previous someone posted to HN about the 737 MAX entries in the ASRS reporting system. Among those reports were complaints that pilots couldn't find the gauges quickly and that they were taking much longer to scan the gauges because they were so different.
It's also incorrect. The digital displays were introduced with the 737 Next Generation in 1997.
The Max cockpit eliminated the five remaining standby gauges, but all primary flight information had already been moved to flat screens.
It makes a lot of sense when you consider user adoption as an important metric. Familiarity will trump redesigns most of the time.
Don't know the details, but maybe at some point, it could have paid to ask some experienced pilots and UI specialists what they thought would be best.
Skeumorphic design, just like the first iOS emulated real world objects to help new users transition into the digital world.
Something else that's worrying is this comment from a technician:
His internal assembly designs for the Max, he said, still include omissions today, like not specifying which tools to use to install a certain wire, a situation that could lead to a faulty connection. Normally such blueprints include intricate instructions.
I hope that all these failures are investigated and addressed before the plane is allowed to fly again.
I can't really see any decision point where an engineer might have stood up and said "this plane isn't safe," like Allan McDonald did with the Challenger. The article tries to hang blame on the decision not to upgrade the cockpit info displays, but there was nothing wrong with the old display systems. It's still not clear if the plane is actually aerodynamically flawed or if the MCAS was simply programmed poorly. Even the business decision was fine; from the perspective of a non-technical executive, "add newer engines but change as little else as possible" seems like a pretty reasonable directive and not likely to cause safety issues. Engineers could have complained about the pace of work but I think it was made clear to them that they were fighting for their jobs: Boeing has had numerous 10,000+ workers layoffs in the past. With everything we know now, I can't see any criminal charges being filed in relation with this disaster.
Not having three AoA sensors seems either insane or criminally negligent.
Yep, there’s going to be a lot of hand wringing, finger pointing and hot air expended over the next few years and this is basically it. Boeing had two options:
(1) 3 sensors plus majority voter.
(2) A mandatory AoA disagree indication plus some training on how to react to it.
They chose option (3): Neither. Frankly when I heard there were just two sensors and no disagree indication, my first thought was well that’s just as good as one sensor and hoping for the best, isn’t it? The “challenger moment” would have been after the meeting they decided on this.
It's more literally "just one sensor" than you say, I think. MCAS doesn't average or anything: it just picks one sensor at a time arbitrarily and uses it. (This will change in next month's software fix.)
(2) sounds like it could be airworthy, but I think Boeing might instead find that it has to add that third sensor. Airbus has three, and any rationale that Boeing only needs two because the disagreement consequences are not severe seems atop quicksand at this point.
That's what really amazes me. Especially since AoA vanes are known to be troublesome.[1] In most aircraft they just trigger the stall warning horn and stick shaker; they don't directly affect aircraft control.
[1] https://mooneyspace.com/topic/19801-stall-warningaoa-failure...
I think Airbus will disable the autopilot in case of AoA sensor failure, which is why it has three of them instead of two.
Option (4): input from other sensors (altitude, climb rate, gyroscope/artificial horizon, pilot actions etc) for a sense check...?
My gut tells me aerospace errs on the side of simplicity and reproducibility. It could work, though ideally system errors wouldn’t interfere with other systems.
And the engine stats should be a good source of data.
It is worth pointing out that an AOA sensor should not be critical for normal flight. If a sensor is faulty then why not simply stop using angle of attack as a data point. It should still be perfectly possible to fly safely and using a configuration that will avoid a stall. Pilots should be able to fly on a minimum set of instruments.
As a pilot myself, that doesn't strike me as disqualifying. The minor problem I have is that it has has no self-verification/disqualification mechanism; even in the face of having two sensors available! The far bigger problem I have is, the automation discounts pilot input as if it's the pilots who are wrong. That's obscene. And it strikes me as a violation of CRM.
I do not accept that pilots must have disabled auto trim in order to prove they are the more valid input source, compared to a single alpha vane sensor. That's perverse. Pilots have to flip switches to prove they are working correctly? Yet the sensors don't have to have self-verification/disqualification, or cross check with an available second sensor?
They could have also used inputs from other systems as a sanity check such as altitude, air speed, pilot input, etc. I'm really surprised the software didn't take any other available data into consideration.
The horizon indicator alone should serve as a check. If you (the computer) think the plane is about to stall, it makes sense to nose it down to compensate. Ok, cool. But if you think it's stalling, and you see that you're at a negative attitude, then it's much more likely that trimming the horizontal stab is a bad idea.
I'm sure there are other checks as well. Also not sure if I'm missing something with this armchair analysis.
I'm with you on that. It also seems completely against the Boeing ethos of when the auto pilot is off you should be hand flying the plane and your control inputs dictate the movement of the flight surfaces. That has been a perceived difference in philosophy between Boeing and Airbus. MCAS sounds like a hastly thrown together work around and a disaster waiting to happen.
Has it been established that the AoA sensor malfunctioned?
I believe the Lion Air investigators have made public that there was a 20 degree differential between the two AoA sensors even when they were sitting on the runway before flight. (I don't have a source easily accessible.)
That's almost like saying two compasses should agree while standing on the north pole. These sensors need airflow to operate and provide meaningful indication.
It was during taxi for takeoff: https://theaircurrent.com/aviation-safety/the-world-pulls-th...
Sure, but they maintained their twenty degree difference for the duration of the flight. That's why the one stick shaker started going off shortly after rotation, why autopilot wouldn't engage, and why MCAS was going nuts.
Is that necessarily true? Based on this article (https://www.flyingmag.com/how-it-works-angle-attack-indicato...) it seems like they should be accurate regardless.
Why should an AoA sensor require airflow? And if we are talking about airflow, we are talking about measuring pressur differentialsm right? How to do calculate an angle using a pressure differential?
It’s literally just a metal plate that rotates with the oncoming air.
Ok, makes sense.
Not if the engineers were assured the pilots would be trained to quickly recognize trim issues and flip off the MCAS when it started misbehaving.
No, it's still obvious fail-deadly insanity. Having to say that the pilots would need to quickly notice issue is even worse (have you seen how you disable the system? It's not a button that you push).
The point of the plane variant was to not perform any additional training, too.
Anyone saying that to the engineers should be considered a criminal. There is probably a whole incentive structure that lead to this and that should be upended completely.
"Oh darn! The pesky flight control system decided to go into crash the plane mode again. Let me reset it before I take another sip of my latte".
Plane tilts down due to erroneous inputs.
Pilot solution:
A) turn off autopilot
B) learn how to play MCAS override, current high score 6 minutes.
Plane maker solution: Get rid of MCAS and deal with the fallout that will broadcast, and stop trying to ONLY blame pilots.
Boeing is in trouble, the world is no longer revolving around the US and outside of the United States it’s very clear that Boeing is to blame.
Not a good year this for Boeing, there has been major crashes of the 707 and 767 in the last 2 months, apart from the 737 Max loss.(Though 707 crash was due to lt landing in wrong airport by mistake, where the runway was not long enough, so it crashed into a wall).
It is interesting and a bit disconcerting to see how a question like this one for some quickly turns into the the same type of partisan quibble as an Android-vs-Apple or Emacs-vs-vi or Linux-vs-Windows question would. If there were ways to map answers onto a globe I expect the 'pro-Boeing' answers to mostly come from the north-American continent and the 'pro-Airbus' mostly from the Eurasian and south-American continent with more diverse answers from the other continents.
The planes crashed, there is nothing partisan about that.
That is what makes it disconcerting to see the same clan-like attitude arise in this discussion. It is one thing to 'defend your team' when talking about mobile user interfaces, freedom of choice of where to get your applications from or the relative virtues of different software development models. In this case two crashes seem to be partly caused by design problems and as such it seems to be an inappropriate response to try to 'defend the team'.
This seems to be getting worse and worse for Boeing, and they definitely aren't acting like they understand the gravity of the situation. I guess Boeing has been coasting along based on its position and reputation for a few decades and this is the result.
They understand, they are just downplaying.
That's not really accurate. Boeing is under continuous attack by hatchet jobs like this that insinuate they cut corners and are solely responsible for these accidents.
First, we don't have final reports from the investigators yet, so it's awfully early to point the finger.
Second, every major aviation accident is multi-factorial. It's never just one failure that causes it.
If it does turn out to be the faulty AOA indicator causing the electric trim to go nose-down, there are still a number of other obvious contributing factors in addition to the faulty sensor.
The public is demanding low airfare prices because they are getting squeezed by the increasing disparity of wealth worldwide. Wages are not rising as fast as prices, and as the cost of doing business with China slowly rises due to the trade war, prices start to creep up and the squeeze increases.
Airlines respond by flying pilots with lower time and lesser training, paying them less, and working them harder.
Pilots spend less time in the simulator working on abnormal conditions, and while they are undoubtedly great at monitoring normal flights and navigating controlled airspace, they have less experience hand-flying approaches and dealing with rare equipment failures and emergencies.
Every pilot should have adequate simulator time to be competent with every emergency procedure for which there is a checklist, but that is not the reality. The three seconds allotted by the FAA to diagnose critical systems failures is simply not enough if you can't find and execute the correct checklist in that time period.
In the old days, every single pilot from a Cessna 152 on up knew exactly what a badly trimmed airplane felt like and how to fix it instantly. When you felt that extra force on the controls, you would instinctively rotate the trim wheel in the direction of the force that you were needing to apply.
Same for electric trim systems: if the force doesn't ease the way it should, you have a runaway and you need to interrupt power to the electric trim system.
But that is hand-flying, stick-and-rudder-type stuff. If you're not getting the hand-flying time and the simulated failure time, you just don't develop that instinct.
It's not entirely Boeing's fault that an aircrew can't recognize and counter a runaway electric trim, no matter what the details in the flight manual. It's only reasonable to assume that basic level of competency.
All pilots of Boeing aircraft know that when the autopilot is off, there is no automation between the controls and the control surfaces - until the 737 Max changed that. The MCAS system is only active when autopilot was off, a big change. Imagine the faulty AoA sensor is causing the aircraft to hunt around to different altitudes. The pilot switches off autopilot by just applying force to the controls and suddenly the plane starts pitching down.
>All pilots of Boeing aircraft know that when the autopilot is off, there is no automation between the controls and the control surfaces
This isn't even approximately true. Pretty much all passenger jets since the 50s and 60s have had yaw dampeners, for example.
True, but a yaw dampener is sort of like a steady cam, it isn't going to over-rule a pilot's rudder input.
Put yourself in the seat of a pilot who has flown an electro-hydraulic 737 for years. Something "funny" seems to be going on with the trim, so you take control and the trim seems to be working perfectly while you manually toggle it, but then the MCAS kicks back in after 5 seconds and tries to push the nose down again. This kind of behavior is coming from a system Boeing did not tell the pilots about.
True, but a yaw dampener is sort of like a steady cam, it isn't going to over-rule a pilot's rudder input.
No, but a rudder hardover might ;). The 747 and 767 were sometimes equipped with stick pushers as well.
> This kind of behavior is coming from a system Boeing did not tell the pilots about.
True for the first crash. However, no longer true by the time of the second crash.
I cannot agree more. After the 1st crash you would think every pilot would have become familiar with this system and how to override it. The stuff that has come out from the most recent crash shows that the pilot was read through manuals trying to understand what was happening. Given the most recent crash, why would he not think, hey lets disable this new system because my plane is acting in the exact same way. I am not saying that Boeing is not at fault for poor training or documentation but if I was flying the same plane as one that recently crashed I know I would have known everything I could about that crash before I lifted off in that same model.
Not likely. When the first crash happened Boeing try to shift the blame to Lion Air citing lack of maintenance and what not.
As many report have already mentioned: the MCAS is not in the manuals.
After the first crash Boeing should have pulled that plane out of service, period. It shouldn't be up to pilots to try to find workarounds for rotten engineering.
The first crash can be chalked up to engineering errors, corner cutting and the desire not having to retrain and recertify pilots.
The second crash is outright criminal by Boeing, for not immediately pulling that plane out of circulation after the Lion Air disaster. Regardless of the cost (which will be much, much more expensive after crash 2).
Their cozy relationship with the FAA also didn't help and I hope the people responsible pay dearly for that.
Throwing the pilots under the bus is how they tried to handle that PR desaster. Doesn't seem to work well, though.
Still an unnecessary cognitive load.
Not a Boeing driver, but in a few GA aircraft I flew, runaway trim can happen regardless of AP on/off status.
Yes it can happen due to a jammed switch, relay, wiring short, etc.
You can however disable the MCAS and it is apparently well documented in the pilot training material. When the trimming wheel acts strangely this is a sign that something may be going wrong and this is part of what pilots need to know when flying this aircraft.
Now whether or not such information is widely known among all pilots is another matter altogether.
MCAS wasn't, runway trim was, however, I don't believe the pilots would expect/recognize a runway trim failure on the occasions that MCAS would fail
I agree with most of your points in general, but Boeing tried as hard as possible to pretend MCAS needed no training. There WAS no simulator scenario to train on for this failure.
Based on accurate descriptions of the intended scenario for MCAS, they would be right. When the system is working, it does what it was designed to do. The failure mode when an AOA sensor goes on the fritz is the problem. The proposed fix is what they should have shipped out with the first plane, that's the real failure here -- someone at Boeing surely saw this coming and raised a flag, and got shouted down. A reckless decision given that the 737 is a cash cow and historically such a successful line of planes that I imagine Boeing would be keen to keep the reputation intact.
Sort of with you, but I think once you're willing to admit that MCAS failure can be catastrophic, airworthiness regulations may require three AoA sensors (as Airbus planes have) so that you get error correction, rather than the two that should have been being used to detect disagreement (but weren't).
I think the issue is that Boeing didn't see a potential MCAS failure as really any different from any other cause of runaway trim, for which there was well-established procedure and training. Clearly at least not all pilots seem to recognize this in time, particularly with other distractions caused by a faulty AoA reading, such as stick shaker, other warnings and alarms, and all of that happening at low altitude.
I don't think that matters here, though I agree with what you said. There's also going to be redundancy on the other mechanisms that can lead to runaway trim, because runaway trim can be catastrophic, because we don't assume that pilots are perfect, and because (as you say) runaway trim can happen in situations where the ground will necessarily arrive before your recovery does.
I think it takes around thirty seconds for the trim motor to move you from one end (where both crashed planes had it) of the jackscrew to the other. And that's with the motor! If you cut out the motor because it was literally trying to kill you -- and as Boeing advises you to -- you'll have to use the hand crank and it will take much longer. Runaway trim at low altitude is death.
It really seems to me that the MAX as shipped was not plausibly airworthy (due to the use of a single sensor). I think even Boeing's going to agree eventually.
A "more right" solution would have been to implement a "stick pusher" system to make it obvious to the pilot what was going on. But that would have required pilot training and punctured the illusion that the plane can be flown by any pilot who has flown any 737 made since the 1960's
Boeing is solidly at fault here.
I have to preach the idea that networks and computing are not magic. While yes, I cam talk to people all over the world, the information I'm trying to communicate still has to be put in front of a person to be communicated.
An aircraft company should treat information dissemination to pilots as as critical a toolchain as their supply and manufacturing processes.
If your tool cannot be used safely, your job isn't done, no matter what your marketing people say.
If it were a financial services, or big data cpmpany maybe I'd lend credence to the safety of leaving that out.
Not aviation. There is too much at risk there. Flight is the equivalent of riding a bubble of air to your destination, which necessitates the continuous balancing of aerodynamic forces, facilitated by increasingly complex hybrid systems of direct human control and automation.
At the end of the day though, a pilot/plane combination should be able to be salvaged even with catastrophic loss of piloting aids, even with catastrophic loss of integrity of the automation on board.
Automation should make flying a plane easier. Not render pilots ineffective when it malfunctions or fails.
Has the same issue happened for airbus with half a thousand dead, and any of their planes grounded world wide?
Well the maiden passenger flight of the A320 crashed at the Paris Air Show, and the pilot said the fly-by-wire system didn't let him pull up[1]. Officially it was pilot error though.
There have been nearly 1,400 fatalities with the A320, with some pilots blaming the fly-by-wire systems, but many of those happened before the age of Twitter and social media virality of this sort of thing so who knows what the public reaction would be today.
[1] https://en.wikipedia.org/wiki/Air_France_Flight_296
The A330 had some weird pitch down incidences due to a faulty ADIRS, and obviously AF447 due to faulty pitot tubes and the completely idiotic issue where the control sticks aren't synced and the inputs are averaged out before being sent to the plane. There were some considerations given to grounding the fleet, whether or not Airbus wanted to admit it at the time.
https://www.reuters.com/article/us-france-plane-denial-sb/ai...
A330 has fewer total fatalities over its 27 years of service (339 deaths) than the MAX does in a year and a half (346 deaths).
The pitch down incidents I believe were caused by a non compliant part replacement (I don't remember which company it was though)
There are several pilots who've had this very issue happen to them and they managed to diagnose and address the problem without flying the plane into the ground.
These incidents are almost always the result of a combination of errors ranging from negligent engineering and documentation to mechanical defects to human (pilot) error. We simply don't know all the facts in these two crashes.
The publicly available information to me indicates negligent documentation (pilot manuals should have been updated to reflect the new mode and how to treat the issue similarly to runaway trim), negligent sales practice (the AoA disagree feature shouldn't be an option), and poor reactions by the pilots involved. But that's purely speculation at this point: there could very well be some other causes instead of or in addition to these.
Air France Brazil to France flight.
Is that a serious question, or did you just not do any research? Yes, Airbus planes have crashed due to malfunctioning automation. It hasn't even been that long since one of their newest planes actually experienced a problem eerily similar to the 737MAX issue, but got lucky in that it occurred when the plane was higher and had more altitude to trade for time and the pilots were able to regain control.
Yes, I also tried to google if airbus grounded thier entire fleet, but nothing came up, so I thought there were not any systematic issues.
Im not a comercial plane enthusiast either.
> If it does turn out to be the faulty AOA indicator causing the electric trim to go nose-down, there are still a number of other obvious contributing factors in addition to the faulty sensor.
There's no serious argument here. It isn't airworthy on an airliner to have a system with flight control capability using one sensor with no redundancy. It doesn't happen anywhere else and there are regulations that forbid it. Airbus uses AoA for autopilot and therefore puts three AoA sensors on the plane with majority voting.
It appears that Boeing (during certification) either lied about the severity of MCAS failure, or lied and said they were using two sensors when they weren't.
I wonder if Boeing and their engineers instinctively knew it was their fault after the first crash, or at least had a feeling/intuition, and how many hoops they had to jump through to cover it up only for it to come up again
Boeing is still going to clean Airbus' clock with the 737MAX. This isn't the first time they've had something like this happen, soon enough people will forget and this plane will most likely go on to become yet another wildly successful 737 variant, safest in the world. Maybe they will downplay the MAX name, though, and market it simply as 737-7, 737-8, and 737-9 going forward.
In 2018, Airbus sold 560 3XXneo, while Boeing sold 720 737 max-X. The year before, it was 925 (Airbus) vs 760 (Boeing).
Looking at the chart since 1980, the 737 and 320 lines have had eerily similar sales records: https://en.wikipedia.org/wiki/Competition_between_Airbus_and...
So it's quite possible that Boeing will see limited impact from these crashes. But no clocks are getting cleaned.
The one that really stands out for Boeing is the 777. I fly a lot and liked Airbus for long flights more, but as airlines upgrade from A340 to the 777, it's always for the better. I would still take the 380 if available, though.
Yes, like McDonnell-Douglas renaming the later revisions of the DC-10 as the MD-11.
The MD-11 even included "a partly computer-driven horizontal stabilizer. Updates to the software package made the airplane's handling characteristics in manual flight similar to those of the DC-10" [1]
Sounds like Boeing might have dusted off an old MD idea.
I think you're probably right, they will improve the systems, improve the training, probably pay some sort of settlement, and as long as no smoking-gun evidence of deliberate malfeasance is found (ala Volkswagen Dieselgate), they will survive. Heck, Volkswagen survived, anyway.
[1] https://en.wikipedia.org/wiki/McDonnell_Douglas_MD-11
VW Dieselgate didn't directly kill 400 people, though.
Why? Both competitors have put new engines on old frames. Boeing has the MAX; Airbus has the A320neo. As far I can tell, the two planes are comparable.
Also, there's already a 737-700, 737-800, 737-900.
A320 wing is quite a bit higher than the 737.
Yep. So a kludgy fix wasn't necessary on the A320 like it was on the 737.
Also the A320 is fully fly-by-wire and has three alpha vanes so even if/when logic similar to MCAS was needed... it could be implemented in a safe and sane manner.
Fool me once... I’m certainly not going to fly Boeing anymore
You have no choice. First the install base of old models is huge and actually quite safe. 777 hasn't had a single crash yet (I don't count the hull losses of Malaysian as crashes). 787 is amazing plane.
And airbus cannot ramp up production enough to fill the whole midrange single isle market.
So Boeings will be bought by airlines. Or the exopansions will be crippled and tickets will fly trough the roof.
I see the same age my Startup all the time.
It is go go go all the time. Except, it is not a plane.
Ll
Something is rotten in the state of Washington