The world pulls the Andon cord on the 737 Max
theaircurrent.com
theaircurrent.com
I think the word they were looking for was 'Samsung Note 7' not 'Andon cord'.
I'm not an aviation expert, but why should something that seems as important as an indicator of system malfunction be an optional package instead of builtin?
Seems an analogy that’d rapidly break down.
You might want to try to strengthen your argument by explaining why an analogy between cars and planes can‘t hold (one moves only in „2D“ vs. the other one moves in „3D“ for example)
a plane crash kills a lot of people
The training to drive a car vs a 737 is Hugh
In what way is it preposterous?
But, in all fairness, even without the "AoA disagree" indicator there were telltale symptoms on the Lion Air bird that something was wrong with the alpha vane (the sensor in question). The most obvious was that only one stick shaker was going off (each control column has a shaker which only takes input from the alpha vane on its side). That's a pretty obvious symptom.
However on the previous Lion Air flight there were two other symptoms written up in the maintenance log[1]: "IAS (indicated air speed) + ALT disagree shown" and "(elevator) FEEL DIFF PRESS light illuminated". On the MAX, both of those systems take angle-of-attack into account (which is new for the MAX, IIRC).
As an aside, American Airlines 191 had a similar situation. Their DC-10 had only a stick shaker on the captain's control column, a second stick shaker was a paid extra. Boeing, of course, bought McDonnell Douglas years later.
1: http://www.jacdec.de/WP/wp-content/uploads/2018/10/2018-10-2...
Stick shakers are noisy, but I suppose you would also ask and cross check the instruments. If only one stick shaker goes off you'll probably get various "something disagrees" lights going off, which should prompt you to check. Take this for instance:
https://aviationweek.com/awin/boeing-addresses-pitot-tube-an...
You can see a picture of the wheel here:
https://www.quora.com/What-are-the-spinning-wheels-in-an-air...
The pilots would be very familiar with the sound and what it represents. The trim wheel also spins when the trim is running, a large and obvious indication (I posted a link to a photo of it).
> Boeing issued a multi-operator message (MOM) explaining the MAX’s manoeuvring characteristics augmentation system (MCAS) “commands nose-down stabilizer” in certain flight profiles using “input data and other airplane systems.” MCAS is operated by the flight control computer and “activated without pilot input and only operates in manual, flaps-up flight,” and MCAS is not part of previous 737 designs.
> The Allied Pilots Association (APA) told American Airlines (AA) pilots in a message on its website. “It is not in the AA 737 Flight Manual Part 2, nor is there a description in the Boeing FCOM. It will be soon.”
> A multi-page document issued by the airline’s flight operations department that highlights the differences between the MAX and 737 NG does not mention MCAS or any other changes to the auto-trim system.
> A multi-operator message (MOM) from Boeing on Nov. 6 cautioned that “an erroneous AOA” can trigger automatic nose-down pitch-trim.
There are lots on indications that at least in the Lion Air case it was not in manuals or communications to pilots.
Further here:
https://www.wsj.com/articles/boeing-withheld-information-on-...
https://outline.com/https://www.wsj.com/articles/boeing-with...
The pilot of the same airplane on the prior flight to the Lion Air crash did just that.
Pilots are given all this information and are meant to read it before takeoff but there is no way to enforce that.
Maintenance logs show the AoA vane was replaced, but Lion Air has a sketchy history with maintenance and what's written in the logs doesn't always reflect the reality, they are one of the cheapest airlines in the world and need to keep planes flying. I'd say that's likely the root of the issue combined with pilots not following the procedure books when faced with anomalous behavior.
https://www.airlineratings.com/news/lion-air-plane-fault-fou...
I hear you about runaway trim, but it seems that you are quite focused on the blades of grass and not looking so much at the lawn.
Nobody has given me an adequate answer to one simple question: what is the indicator the industry will use to determine when it has made the cockpits so complex that the complexity itself becomes a danger? Because we can play this game for a few decades more: manufacturers mod-up old planes with new software, extra training is added to the pilot's schedules, there are crashes where commenters in good faith can say "but that's an obvious part of any pilot's training". Repeat and rinse -- with the proviso that with each round the overall complexity continues to increase.
Technology developers, more than anyone else, are quite cognizant of the fact that we can create technology we ourselves cannot understand. Perhaps the aviation industry and the associated regulators somehow missed this?
The pilots are supposed to know how to deal with runaway stab trim. It doesn't matter why it was running away, just that the pilots know how to deal with it. Whether it was MCAS or the autopilot or a short circuit, does not matter.
After it is safely back on the ground, then the specific cause of the failure can be ascertained and corrected.
Let's take engine failure. When you're training twins, you're going to get one of the engines pulled on you quite a bit -- usually when you least expect it. That's because a lot of people died educating the industry to how important it is to be able to handle engine failure in all flight modes: takeoff, climb-out, cruise-climb, and so on. That reaction sequence has to be drilled into pilots to such a degree that there's no thinking involved.
But runaway trim? Seriously? Sure, you'll get the training, but in all modes of flight? Drilled into you until you can handle it in your sleep? No way. That's preposterous. We _thought_ we knew that those kinds of problems don't happen at weird times to cause people to die. So if you're flying along in cruise and you've got a runaway trim, somebody does a mental lookup -- which might take 3 or 4 seconds -- locates the breaker, then throws it. We do this other type of training a lot too, but there are tons of subsystems on your average commercial airliner. We don't train for that the way we train for engine failure. We've got huge reams of checklists in commercial cockpits dedicated to this kind of slower problem-solving.
So yes, in both cases a person could argue that training was either not given or not implemented by the crew. But that ignore the realistic limitations of trying to train crews on modern equipment. You simply can't do some kind of weird cross-tab grid where everything is trained everywhere and to the same degree. At some point the human factor has to come into play. People aren't robots. It looks like these accidents happened on takeoff/climb-out, one of the most busy and complex things a crew can do (not near the complexity of hand-flying the various instrument approaches, of course).
You gotta ask yourself: if I'm watching my turbine numbers, my airspeed, looking for traffic, the copilot's talking to the pax, and so forth? Would I catch a runaway trim right away? More to the point, if I missed it, would the ensuing chaos, _in some cases_ prevent me from being able to cognitively switch back to diagnostic mode? After all, we teach pilot when all else fails, fly the plane first. Add to that systems like MCAS that might exist in the software that the pilots are unaware of?
If these accidents turn out to be MCAS/runaway trim related, I would be interested in learning about the crew environment when it happened, specifically other issues taxing the pilots and whether or not the flight director was engaged.
So yes, sure. You can train your way out of this. At some point, however, you have to ask if the cost we're paying in lives is worth the lessons we're learning which all seem to boil down to "people are cognitively limited in many ways"
I'm sure the training issue will be prominent in the NTSB report.
Note that stall recovery is heavily trained, but airliners still crash because the pilot reflexively commands nose up in a stall instead of nose down. And the MCAS system is there to nose it down in a stall.
Not so. First: before Lion Air accident, nobody knew there is a new device that can move the controls that way under these conditions (in that phase of flight etc). The whole device was kept secret by Boeing. Second: the pilots had the trained reflexes what they are to do, and with these, there are more steps to try to overcome such movements before the decision to use the switch. And that’s exactly what the pilots did: attempted the steps before. Which seemed to help, but MCAS kept misbehaving. As the seconds matter, then it was to late.
The reason the stab trim cutoff switches are there is so the pilot can stop runaway trim. The switches are prominently placed.
I expect the failure of the pilots to throw those switches to be prominent in the eventual NTSB report on the accidents.
The second accident would be especially perplexing because surely the pilots would have known about the Lion Air crash. If I was a 737MAX pilot, I'd be keenly interested in other crashes in the same aircraft, so I could ensure it wouldn't happen to me. Wouldn't you?
The stabilizer trim motors are very powerful and do not need to be offloaded in order to work.
https://www.nytimes.com/interactive/2019/03/13/world/boeing-...
Have you seen the graphs? There are 20 seconds intervals. They “fight” the plane, then something (the investigation is still on what) makes it worse again.
That’s what confused the pilots: the misbehavior repeats after they think the plane returned to normal.
It's like if an engine is on fire, and I shut down the engine, and the fire goes out. There's no way I'm going to think "It's OK now, I can restart the engine." No way in hell.
However:
https://news.ycombinator.com/item?id=19420964
"pilots and aviation experts say that what happened on the Lion Air flight doesn’t look like a standard stabilizer runaway, because that is defined as continuous uncommanded movement of the tail."
"On the accident flight, the tail movement wasn’t continuous; the pilots were able to counter the nose-down movement multiple times."
"In addition, the MCAS altered the control column response to the stabilizer movement. Pulling back on the column normally interrupts any stabilizer nose-down movement, but with MCAS operating that control column function was disabled."
And do you really agree with the simplified interpretation like:
https://news.ycombinator.com/item?id=19424761
"two pilots fell out of the sky to their deaths and it simply never occurred to them to try pulling back hard."
I still believe that the way the airplane behaved in these two cases was exactly the opposite of what the pilots have been trained in their flights and in the simulators, and that the behavior was counter intuitive and unexpected to them and that that is the only reason they weren't able to save themselves.
Good UI is not trivially obvious. And it really makes a difference between the life and the death in certain use cases. And thinking about something in the safety of your armchair is very different from "having the plane that is doing exactly what you don't expect and then you die." The plane behaving the very way you haven't been trained in the simulations before.
Finally, I believe that all the issues reported here
https://www.seattletimes.com/business/boeing-aerospace/faile...
contributed to the manifestation that turned out to be deadly:
"The safety analysis:
- Understated the power of the new flight control system, which was designed to swivel the horizontal tail to push the nose of the plane down to avert a stall. When the planes later entered service, MCAS was capable of moving the tail more than four times farther than was stated in the initial safety analysis document.
- Failed to account for how the system could reset itself each time a pilot responded, thereby missing the potential impact of the system repeatedly pushing the airplane’s nose downward.
- Assessed a failure of the system as one level below “catastrophic.” But even that “hazardous” danger level should have precluded activation of the system based on input from a single sensor — and yet that’s how it was designed."
Interestingly and tangentially, the software people particularly like to blame the user. I've worked in many teams wit more people almost automatically dismissing any user input. But the users are, in fact, typically right in a sense that they often have the real world problems that are simply not recognized by the designers/developers assuming infinite knowledge and the infinite time the user has.
It could well be that it is obvious for anyone with the proper training, but then maybe not all airline pilots get the proper training? Or if they have the training but are pushed to hard in the name of cutting costs, and profits?
However, if it indeed was expected to be obvious to all pilots, why even - as I understand it - have the warning on the optional HUD?
Seems like bad safety engineering to have extraneous warnings possibly increasing cognitive load in a a crisis situation.
Reality: Hundreds of people die within months. Boeing is now worth $25 billion less in market cap and the planes are grounded worldwide.
I can say for example, that tomorrow Airbus is going to get broken up and turned into a mess because of Brexit, and everyone from the President of France to the Airbus leadership can be blamed for it.
Reality is anyone can blame whatever they feel like these days. Anything surrounding blame can be safely ignored. Look for the people talking about the solutions.
After you find said individuals, someone has to still fix the problem. And in my experience you always need the help or information from said individuals to do so.
CHOOSING to focus on blame, only produces attacks, defensiveness and avoidance from whom ever you are blaming, when they can be contributing to the fix.
Reaching the solutions get pushed further down the road.
Whenever a crisis unfolds you want the people who created it in the room contributing info, thinking about solutions, rather than focusing on how to save their asses and hiding what they did.
Current culture puts too much emphasis on passing judgements and blaming people. What outcomes are being produced speak for themselves when that route is choosen.
The 737 Max order backlog ( just over 5,000 aircraft ) has a list-price value of about $600 billion. Even if we assume 50% discounts that's still a lot of revenue.
> Lion Air 610 should never have been allowed to get airborne on October 29, a conclusion shared by those familiar with the inquiry. The plane simply wasn’t airworthy.
Get the feeling there will be a large amount of cognitive dissonance on HN once the final report is released.
Less than three years ago Boeing's stock was worth around 130 USD. Friday it was still 370 USD, almost 3 times more than that.
Less than three years ago its market capitalization was around 80 billion. Now (even after the grounding of 737 MAX) it's still around 240 billion. What happened in the last less than three years? At least, the first 737 MAX planes were delivered around two years ago.
Apparently Boeing had (before the crash) a backlog of 5000 orders for 737 MAX planes, worth 490 billion.
On Boeing's own site:
https://www.boeing.com/commercial/market/commercial-market-o...
"Commercial Market Outlook 2018-2037"
"Robust demand is expected the next 20 years as strong economic growth, growing middle classes, increasing consumer spending on services, and evolving airline business models bring more value to passengers and support the long-term outlook. As a result, the industry will require more than 42,000 new airplanes by 2037 with almost 74% in the single-aisle category."
Looking at all that it's even more obvious why there was such a reluctance to ground the 737 MAX in the US.
I know this is just impactful writing, but the more I read about the 737 Max, the more I feel that the business decisions behind it are somewhere in between Intel speculative execution and "fly fast and break things."
Why did they keep the system on with diverging data?
It will be nice to know what are the risks when MCAS is off. Maybe x% of pilots used to the old 737 consistently stall the plane on the simulator.
It seems only one AOA sensor is currently used by software. The update will change that.
"The company said it will change the MCAS software to give the system input from more than one AOA sensor. It will limit how much MCAS can move the horizontal tail in response to an erroneous AOA signal. And when activated, the system will kick in only for one cycle, rather than multiple times."
https://www.seattletimes.com/business/boeing-aerospace/inves...
That's even worse than I thought. The data from both sensors was being logged. Some reports indicated cases of huge discrepancies (20 degrees) between sensors. It is incomprehensible to me that MCAS ignored the other sensor. The lawyers will have a field day with that and in this case I say: go for it!
Disclaimer: I've never worked on aircraft software. I've worked on unmanned spacecraft and the scheme I described is very common for fault tolerance.
Using automated systems to adjust the flight characteristics has been going on at least since the 707 with its yaw damper, and likely much earlier.
There's nothing fundamentally wrong with the 737MAX. An entirely new airplane would entail more risk. Altering the 737, with known and proven characteristics, is low risk.
This would be like Harley Davidson putting a much more powerful engine in an old bike frame, perhaps because they feel threatened by new technology. However the new engine is so powerful it creates wheelies, and potentially fatal accidents as customers were not made aware they'd need to change their bike driving habits.
There is something fundamentally wrong with the 737MAX and how they installed the engines. I'm not an aeronoticaul engineer so I don't know the best solution to minimize the instability. But they certainly should have tried out more configurations, different wing shapes, done more tests etc. Somehow they skipped all that to get more $$
The issue (nose up tendencies at high power settings) was an issue with the 737 Next Generation as well, its just more prevalent with the Max.
Also, nose up tendencies at high power settings is a known issue with all jet aircraft that use underslung engines.
That's glossy.
In our trade, we call that adding another layer of abstraction. And eventually it runs into unbearable complexity and tech debt. Then the thing becomes a disaster.
Sure, everyone does this.
But that does not make it less wrong or less bad.
Pretty much all airplanes have stability issues. Most of the time the pilot is trained to stay away from them, but sometimes they don't and crash it, and then there's a cry to add augmentation to compensate for the nut behind the wheel.
How is that relevant to instability.
And as a matter of fact, passenger airplanes are usually stable by design. What Boeing does violates this basic design principle in flights.
Not so. The yaw damper is an example, used to prevent Dutch Roll.
> Altering the 737, with known and proven characteristics, is low risk
But that's the problem; altering aerodynamics, adding three tonnes of empty weight, new FBW wing spoilers and a higher thrust line means that the characteristics are no longer proven and you should be testing from scratch again.
Airplane design is constantly changed throughout production. This is normal, and Boeing knows how to do these things. Re-engining, altering wing shapes, doing stretch versions, all are routine. All airplanes have instability issues, and there is no indication that the crash was caused by an unknown aerodynamic instability.
https://www.drive.com.au/motor-news/milestones-mercedesbenzs...
"Production was halted for 12 weeks while a crack team modified the chassis.
Then, to be doubly sure, electronic stability control was added."
The rear landing gear could have been made to extend more, by telescoping or folding.
The rear landing gear could have been attached more outboard, letting it be longer without the wheels colliding in the middle. Perhaps something else would need to move a bit to make room.
The rear landing gear could have been stowed as the B52 bomber stows landing gear, asymmetrically with one going in front of the other. This would let it be taller since it would be able to cross over the midline of the aircraft.
An engine could be flatter if it had two turbines side by side. The cost of engine removal is still low since the aircraft still only has two engines to remove, and the pilot training is the same because there are still only two engines to control. Really, that isn't a quad-jet.
Letting the fan portion of the engine peek up over the wing is an interesting thought.
Turbofan airflow already hits the support structures for the engine. Everything is a compromise of course. Tossing a bit over the top of the wing could be beneficial, with the impact of the wing being less harmful than the alternatives.
Notable points:
- FAA delegated System Safety Analysis for MCAS and many other certification steps to Boeing engineers (what can go wrong with corporations policing themselves?)
- Political pressures on FAA resulted in signing off on some certification steps before they were completed
- Actual limit of MCAS’s command was not known to FAA, 737 MAX operators and pilots
- MCAS failure was miss-classified as a “hazardous failure” instead of “catastrophic failure”, which would require redesign
- MCAS was not even mentioned in flight manuals
The new, more efficient engines are bigger and hence didn't fit under the wings of the 737. Hence the "hacks" Boeing did to fit them on 737 that required software augmentation to get it to work safely. A newly designed plane taking into account the size of the engines would have been more inherently stable without software augmentation.
Boeing's solution will probably be to improve the software augmentation by fixing the behavior of error detection and correction in the case of sensor troubles (such as adding clear warnings which some airlines have already added as a optional features)
It's a great plane that connected the world, surely, but there is no denying that the A320 family is just more modern and still has more potential to be squeezed from it. Starting from the trivial facts that it has a higher ground clearance and the cockpit has more room to improve on instrumentation.
It's just that the 737 has been good enough with changes every so often for a long time, so Boeing has done a lot more fully new designs for larger planes; some of which had tremendous gains in efficiency while increasing passenger comfort; the 787 is reported to use about 20% less fuel than the 767.
767 crash in Feb 2019: https://en.m.wikipedia.org/wiki/Atlas_Air_Flight_3591
I don't know if the SLS designated (and mostly built) for EM-1 can do the EM-2 mission or other missions, as ULA purpose-builds each previous rocket (Deltas and Atlases) specific to each mission.
The reason you feel like hell after taking the Redeye isn't that just that you took the Redeye, but you took the Redeye on a 737.
The marketing term "narrow-body" belies that the 737 is wide enough but not tall enough for the human physique. Just thinking about the curve of that circular fuselage makes my neck start to knot up.
Don't believe me? The Embraer 195 is a smaller plane that feels huge on the inside compared to the 737.
More advanced planes like the 787 use electric bleed air to save energy and vent less toxic fumes from the cabin which also makes air travel more pleasant.
The fuselage cross-section dates back to the 1958 Boeing 707.
There is great concern about the environmental impacts of air travel and since 737-class planes (like the Airbus A320) are produced in greater numbers than other aircraft, the flying public, the world, and the airlines deserve something better as an everyday flyer.
The RAF was losing planes too of course, but mostly in friendly territory, so it kept getting the pilots back. Put them in a new plane and you've kept all that valuable real world experience.
Here is how I imagine such a call.
"Oh, our planes are safe, Donald. Who's a good boy, Donald? You are! Good Donald!"
Boeing CEO Dennis Muilenburg reportedly spoke
with President Trump earlier Tuesday,
urging him not to ground the jet.