Hacker News Reader

Comment by gshubert17 | Hacker News Reader

> Interesting tidbit: after the second crash, the Ethiopian authorities decided to send the black box to Europe for analysis, apparently not trusting US investigators with the data.

William Langeweische [0] describes lack of airmanship as contributing to the 737 Max crashes and cites another reason for distrust:

"In the case of the Ethiopian investigation, we have an airline and an investigative body that historically have not been able to isolate themselves from the country’s dysfunctional political life."

"After the cockpit voice recorder was dug out of the wreckage, it was shielded from the N.T.S.B. and whisked to Paris. There, for reasons unknown, French accident investigators agreed to download its contents in private onto a drive for an immediate return to Addis Ababa, where the information remains mostly locked away today and has been withheld in full form from any outside observers."

[0] https://www.nytimes.com/2019/09/18/magazine/boeing-737-max-c...

View on HN

That whole article read as some weird neo-colonial piece, blaming other countries training processes rather than a badly designed aircraft.

It is very rare that any accident has a single cause.

Should those training processes not be blamed? After all, it wasn’t Southwest Airlines that crashed and the sketchy founder of Lion Air certainly didn’t have safety as a core value.

The weird remarks about Ethiopia were quite out of place, Ethiopian Airlines has an excellent safety record. It's also telling that Ted Cruz insisted very quickly after the second crash that the MAX be grounded, it would be have very bad for his career if one had crashed in Dallas and he had declared them safe.

Training is an issue, because the pilots had at their fingertips the means to recover from the malfunction (turning off the stab trim via the cutoff switches).

This doesn't strike me as correct.

The plane was traveling fast enough that the strain on the air control surfaces meant pilots weren't able to manually trim the plane back into alignment.

The only way to overcome those forces was to use the electronic motors to adjust the alignment of the rear stabilizer trim. However, those motors also are disabled with the stab trim cutoff switches.

After the fact simulations confirmed that such forces could well have prevented manual control.

See prior discussion and news articles here: https://news.ycombinator.com/item?id=19573893 and https://www.seattletimes.com/business/boeing-aerospace/boein...

There's no evidence MCAS upset looks exactly like runaway trim in every case, most cases, some cases, or these specific cases. This is a supposition made only by Boeing, and repeated by others. What has since been demonstrated is it's possible for MCAS upset to result in a mistrim significant enough the pilots can't recover in time if they're at a low enough altitude.

So I reject the categorical claim they could have recovered with the flip of a switch.

Further to that point, the preliminary report on ET302 shows they did turn stabilizer trim switches to cutoff, and yet they couldn't move trim manually, likely due to mistrim forces. The logical reason why they turned stabilizer trim back on is it was the only way to get electric motor assisted trim to try and get out of the mistrim. But MCAS immediately triggered again resulting in greater than 20 degrees nose down, and negative G forces by the pilots - it was impossible to recover from that. The final act of MCAS, had it been a human pilot, for sure would be considered a saboteur, it's that ridiculous of a reaction under any circumstance, even had the airplane angle of attack been great enough to trigger MCAS it was a gross overreaction, at low altitude, commanding a path steeply below the horizon, and incompatible with survival.

> There's no evidence MCAS upset looks exactly like runaway trim in every case

If uncommanded trim motor action is forcing the airplane into a dangerous dive, it's runaway trim. The pilots must have thought it was runaway trim as they were desperately trying to counter it.

> So I reject the categorical claim they could have recovered with the flip of a switch.

But that's what did happen with the previous LA flight that landed safely.

> it was the only way to get electric motor assisted trim to try and get out of the mistrim.

That's right.

> But MCAS immediately triggered again

The electric trim switches override the MCAS.

So why didn't the EA pilots do that override? I don't know, neither do you. We'll have to see what the NTSB report says.

I'm looking for a aviation thread where this article was discussed, but I can't find it right now.

But it was heavily criticised. Just from a cursory reading you can see many cases of subtle and not so subtle language choices that show a heavy bias and a string of one-sided arguments.

>I'm looking for a aviation thread where this article was discussed, but I can't find it right now.

HN has this flagged thread, https://news.ycombinator.com/item?id=21004683

A contrary opinion. https://christinenegroni.com/irony-of-pilot-laying-blame-on-...

Does he consider airmanship lacking in the USAir 427 crash, or in Colgan Air 3407? Both cases pilots pulled back on the yoke the entire time making recovery impossible, exactly contrary to all of their training. He's dismissive of "startle factor" in Air France 447 as well, as in, he doesn't even bring it up or any of the other factors in the final report, he just dings pilots as lacking airmanship.

This is not an insignificant point. MCAS was flawed, no question. As a pilot of an airplane with enhanced stability control, I have found that anything that tries to “help” by nose down or nose up during times of unusual flight attitudes is unwelcome and honestly scares the hell out of me when the autopilot kicks on and overrides my inputs. Disengaging the autopilot works for a moment, then it kicks back on: the solution is to pull the breaker when that happens. Granted, in my case, I was attempting to intentionally stall the airplane during familiarization training in a Cessna T206. However, an autopilot with “stability protection” can theoretically fly you into the ground if you aren’t trained correctly. So I am not a fan of the airplane trying to “protect” the pilot by taking over control. However, reacting to system anomalies is a critical part of training. Meaning knowing how and when to react to such situations is fundamental to flying the airplane.

If we stipulate the MCAS system was faulty, that still doesn’t relieve the pilots of responsibility. The Ethiopian copilot only had 300 total flight hours — so it’s fair to say that copilot wasn’t experienced with flying in general, let alone type-specific experience in an airliner. Since the captain would have been flying the airplane, the copilot would have been the one running through the checklists. Airliners require two pilots for a reason; that copilot had no business being right seat in a technologically advanced airplane. Both pilots specifically failed to follow the procedures. First, they didn’t adjust the throttle at all during the event — throttle remained at climb power throughout, secondly, they re-engaged MCAS because while they pulled the horizontal stabilizer trim cutout switches correctly, they failed to realize that they had to use the manual trim wheels since the electric yoke-mounted trim would be inoperative at that point.

Yes, MCAS was deficient, however, 90% of aviation training is learning how to respond when things go wrong. Complaining about one issue while ignoring the other is disingenuous. Good pilots wouldn’t have crashed that plane. There is a reason that airline pilots in the US must have 1500 flight hours before being allowed in the right seat; there is a reason that airliner crashes in the US are so exceedingly rare. The 737 Max incident revealed plenty about Boeing and system design, but it also shined a light on the effects of substandard pilot qualification in places like Indonesia and Ethiopia. Considering the US flew the 737 Max vastly more than anyone else, a broken airplane would have statistically resulted in a US crash, yet the two crashes we did have were with airlines from countries with debatable pilot qualification processes. Attempting to obscure the cockpit voice recorders from public view and giving them to France (home of Airbus it might be added,) means that Ethiopia had something to hide regarding their pilots’ actions. If it was clearly 100% “Boeing’s fault,” then Ethiopia would want all data surrounding the crash to be on the front page of every newspaper if only to bolster their case that their pilots weren’t at fault. But instead, they hide the data. Why hide supposedly exculpatory evidence? Because it wasn’t exculpatory at all.

I get it, MCAS bad. But those passengers would still be alive if it weren’t for bad pilots. Given that Ethiopian Airlines is a crown jewel of the country and a vital marketing tool of the country, it’s clear why they wanted to hide any hint that pilots of the flag carrier were questionable.

> Good pilots wouldn’t have crashed that plane.

> But those passengers would still be alive if it weren’t for bad pilots.

Are you an experienced pilot, intimately familiar with the 737 MAX, or otherwise an aviation expert qualified to be a judge of this?

I can't see how you could make such a statement with any auhtority otherwise, and your profile does not seem to indicate you are.

I am neither, but it has also come to light that Boeing hid MCAS from airlines and pilot training materials, and even hid details from the FAA.

Together with the quick worldwide action by aviation authorities, and the prolonged grounding, even in the US, is enough make this line of reasoning very doubtful.

> Are you an experienced pilot, intimately familiar with the 737 MAX, or otherwise an aviation expert qualified to be a judge of this?

I am not a pilot, but I worked on the stab trim design for the 757. There are cutoff switches for the stab trim on the console, and their purpose is to stop uncommanded trim movement. They were successfully used on another Lion Air flight to recover from MCAS malfunction.

The electric thumb switches will also override MCAS and can be used to trim the stabilizer back to normal, and then cut off further trim with the cutoff switches. In both incidents the pilots were able to bring the trim back with the thumb switches, multiple times, but it apparently did not occur to them to shut off the trim after doing so.

I'm very interested to see the NTSB report on this.

The Seattle Times says that that isn't true: https://www.seattletimes.com/business/boeing-aerospace/boein...

In the 737-NG you could turn off autotrim and still have electric trimming. This was changed in the 737-MAX, if you turned on electric trimming you'd also turn on MCAS. That change was poorly documented, and at sufficient airspeed you had to rely on electric trimming because the aerodynamic forces on the horizontal stabilizer would be too high to turn the trim wheel manually.

> This was changed in the 737-MAX, if you turned on electric trimming you'd also turn on MCAS.

The electric trim switches override MCAS. This is according to Aviation Week, Aug 19, and is consistent with Boeing's bulletins on the matter and with the pitch profile from the flight data recorder - both sets of pilots had overridden MCAS with the electric trim switches in multiple cycles before their crashes.

That's not consistent with other reporting. From the FT:

https://www.ft.com/content/ee4246ea-5729-11e9-91f9-b6515a54c...

Four seconds later — and only 35 seconds after the nose down problem first occurred — the co-pilot suggested they initiate the emergency procedure recommended by Boeing, and disable the MCAS system by flipping switches in the cockpit.

“The pilots diagnosed and executed the procedure within 35 seconds — that’s lightning fast,” said Jason Goldberg, a spokesman for the pilots’ union of American Airlines, one of the biggest US operators of the 737 Max aircraft.

I'd be careful about using Financial Times as a source. I've seen so many articles about this not written by aerospace people and full of errors.

The flight data recorder showed that the pilots had successfully countered the MCAS input more than once with the electric trim switches. In the Lion Air crash, the pilots successfully countered it 25 times. At any one of those times, the pilots could then have turned it off with the cutoff switches. My source is Aviation Week, Aug 19, 2019.

It says: "Electric trim input will stop the automatic nose-down stabilizer movement" on a bulletin Boeing issued on Nov 6, and goes on to say "The only way to stop the cycle is to follow the runaway stabilizer checklist and toggle the console-mounted cutout switches."

This was apparently done by the previous Lion Air flight which encountered the same issue and landed safely.

The Ethiopian Air pilots also successfully used the electric trim switches to override MCAS. After two cycles of that, the pilots did think to throw the cutout switches, but with the nose down. They should have trimmed the plane to normal with the electric switches, then throw the cutout switches.

All according to AW, which I am much more inclined to believe than other reports, until we see the NTSB report.

No, I don't think you do get it. It's not just about the shockingly clueless engineering of MCAS. It's also about Boeing persuading the FAA, and the FAA allowing itself to be persuaded, that additional pilot training for the Max wasn't necessary. You can't criticize other countries for inadequate pilot training without acknowledging that Boeing and the FAA contributed to that inadequacy, and therefore have blood on their hands.

Remember that the previous Lion Air flight to the one that crashed also has uncommanded trim movement, and the pilots there simply shut it off with the cutoff switches and landed without difficulty.

The cutoff switches are there to deal with trim runaway, and there is training for that.

The cutoff switches stop the runaway, but MCAS could max out trim to the extent that it was literally physically impossible to correct manually without steeply descending to take aerodynamic load off the control surfaces. Doing this has obvious complications when it's only a few minutes after takeoff and the pilots are already struggling to maintain any altitude at all.

The flight data publicly available for the three flights, shows rather different MCAS upset behavior in all three cases. They're remarkably similar compared to what you'd expect for a normal flight. But the oscillations in the JT 34 case were not nearly as aggressive as the other flights, no evidence mistrim happened, and in fact the JT 34 pilots didn't recognize it as mistrim, it was the jump pilot who reportedly recognized something (we don't know anything about his thought process so far publicly) and apparently made a recommendation to set stabilizer trim to cutoff.

Is there training for getting out of mistrim at low altitude without the benefit of electric trim? Is there training even for MCAS upset as distinguished from runaway trim? We already know there isn't a way to simulate angle of attack sensor failure induced MCAS upset, in MAX simulators. Exactly how was it demonstrated that MCAS upset looks like runaway trim? And how much faster it commands nose down compared to the typical runaway trim case?

>Is there training for getting out of mistrim at low altitude without the benefit of electric trim?

No.

>Is there training even for MCAS upset as distinguished from runaway trim?

No.

Remember, MCAS was dropped from the manual, and not included in the end training pilot's would be exposed to prior to being handed a MAX. It was nowhere in that presentation. That was covered in the 60 minutes expose.

https://youtu.be/QytfYyHmxtc

>Exactly how was it demonstrated that MCAS upset looks like runaway trim?

It wasn't. Take a look at the ET302 preliminary crash report. You'll see attached to it the documentation pages from Boeing even remotely related to MCAS. In fact...

https://flightsafety.org/wp-content/uploads/2019/04/Prelimin...

Check Page 30 for the memory item as written. The AD from Lion Air is in there too I think.

Note the condition description explicitly mentions a condition where uncommanded trim is running continuously.

Before the AD issued after the Lion Air crash, no one even knew MCAS was a thing.

> Note the condition description explicitly mentions a condition where uncommanded trim is running continuously.

The trim system repeatedly coming on and driving the nose down is runaway trim. The pilot already knows he's in trouble because the trim is running, and he's looking at the checklist on how to stop it. And there is the information on how to stop it. Getting hung up on the definition of "continuous" while the plane augers in is something a computer would do, not a human pilot.

Which is why airliners still have human pilots, not computers, in command.

I was going to comment earlier on something you posted but I wasn't sure it was the time Walter. But hey, here goes.

In reply to someone else you posted to the effect that

>if the trim goes uncommanded, that's runaway trim.

If there is anything I did take out of Langewiesche's article, it is that apparently for some subset of the human species, it appears that the mental optimization you and I are capable of connecting naturally (stab runaway on continuous uncommanded trim-reduces to-> stab runaway on any unaccountable trim), is not, in fact, completely natural to everyone.

I've come to realize I have a team member who is one of those people. I have to be very careful with instructions to them, almost like programming. If I handed him that piece of paper, then asked them whether a pulsing trim system demanded that procedure, I'm not willing to stake my life on him getting it. So life being what it is, I have started to take the possibility of someone being of that disposition into account more frequently.

I've been somewhat disappointed at how frequently I run into it. I'm not saying there is anything wrong with those type of people, just that I can't necessarily generalize the capability with enough confidence to be comfortable with the connection not being proven to be made without demonstrable proof in the form of a simulator session or two.

It's just not a given I'm capable of assuming away anymore. I've seen (and even been the unwitting subject of) too many counterexamples, albeit in less than life-threatening conditions.

I certainly couldn't wrap my mind around why they wouldn't have made the mental connection while actually successfully retrimming the plane. After several months of devoting a hell of a lot of mental cycles to meta-cognition though, I've found I have my own corpus of "Oh, what the hell, how did I not make that connection til now?" which has been the result of many years of habit building.

I think I realized this earlier on, but couldn't convincingly articulate it. It came previously from the idea of psychological anchoring, and it's effect on subsequent responses in the presence of priming. It's a fairly well researched phenomena, and network theory also suggests it's a near certainty that this type of inability to grok can happen if mentation is an emergent result of our internetworked mass of neural nets that is the gray stuff between our ears.

It's still one of those fuzzy hunchy sentiments though, so not really something worth writing a paper about.

I understand that people are different and process things differently. There's nothing wrong with them. But some people aren't suited to be pilots, and flight school is supposed to wash them out. I also don't believe that misinterpreting "continuous" was a factor in the crashes.

One failure scenario that can cause runaway trim is mechanical damage that causes an intermittent short circuit which can cause uncommanded trim. "Continuous" or intermittent, you're going to want to cut off the stab trim, as you would any dangerous piece of machinery that is randomly turning itself on and off.

I have a difficult time conceiving of concluding that "the trim is coming on randomly and pointing me at the ground, but since it's not continuous I'll just let it keep doing that rather than turning it off." I'm not a pilot, but I bet my response would be more like "Holeee phuck, wtf is wrong with the trim, it's going to kill us all! Turn it off! Turn it off!"

As I mentioned, I spent 3 years working on the 757 stab trim system for the 757. Although I didn't come up with the idea, the engineers who did said that's exactly why the cutoff switches are clearly labeled and within easy reach. They're for "the stab trim is possessed by demons trying to crash the plane, shut it off NOW!"

Interestingly, the emergency checklist says to turn off the autopilot first, and if that doesn't stop the trim, then shut off the trim. My tendency would be to stop the trim, then turn off the autopilot, and fly manually the rest of the trip.

For example, there was a crash some years ago where the pilots got an air pressure warning. They dug out the checklist, and started following the procedure. They passed out from hypoxia before getting very far through it.

The checklist was then changed so that the #1 item was "put on your oxygen mask". These things are all so obvious in hindsight, but sadly too much gets learned the hard way.

FAA testing disproves your contention that "good pilots wouldn't have lost the plane." That was part of the reason they eventually mandated the rearchitecture of the flight computer due to it representing a single physical point of failure

https://www.seattletimes.com/business/boeing-aerospace/newly...

One of the three seasoned test pilots (the civilian one) ended up losing the plane due to a single-event upset cascading to false positive activation of MCAS consistent with the Ethiopian Airlines disaster. I.e. the system activating at non-extreme AoA.

Also, not pulling power was justified due to the malfunction of the AoA sensor resulting in an airspeed unreliable state, the response to which is essentially "set throttles to what they should be for that stage of the flight", which was climb out in Ethiopias case, and from a hot and high airport to boot. They also ran through the procedures written by Boeing to a T. The fact that Boeing intentionally withheld important implementation details from the pilots can't really be used against them. The measure of incompetence is to not know something you absolutely should. The Ethiopian pilots had none of that info, and Lion Air swapped in a garbage part, and had bad paperwork in the logs, and furthermore, we're known to be at risk of "flying by rote" by Boeing. This damns Boeing even more, since they knew of the local minima in terms of safe operating style, yet still left out the information those pilots would have needed to safely fly the plane, ostensibly so as not to draw scrutiny from regulators.

In short, appealing to the need of a master airman to fly a demonstrably physically dangerous (and possibly unairworthy given explicit prescriptive criteria in the FAR's) aircraft doesn't speak volumes to the overall safety of the aircraft, which puts fault squarely in the corner of the manufacturer who self-certified the safety of their design.

The pilot's did not perform ideally, but to say their actions were outside of what could be reasonably expected is foolish. This is a system for which they received no training, acts in an obscure and intermittent fashion, and is accompanied by a slew of cabin warnings.

Furthermore, with the overspeed and extreme trim, the trim wheel was likely inoperable, or else required so much force that the pilots reasonably thought it was inoperable. Due to the overspeed, the pilots were in an impossible situation where they concluded they needed electronic trim control while also knowing that this system was threatening their demise.

To place blame on the pilots is to plan to fail.

And not only that but follows a well established pattern of (poor) accident investigations which look at the most proximate event to the accident (the pilots on the cockpit) and assigns the blame to that instead of focusing on systemic issues which are much greater contributors to the overall situation which led to the accident.

The pilots did the best they could. They increased airspeed to have at least some lift despite the excessive mistrim, and they turned electric trim back on because in the 737-NG autotrim stops when the yoke is pulled. No one told them about MCAS and how it behaves different from the model that they knew.

I think there is a lot of misinformation in your post.

The pilots didn't follow the airspeed unreliable procedure, and oversped the aircraft. Maybe it's the best they could do, but definitely not what they were expected (and trained) to do.

Electric trim is not turned off "when the yoke is pulled" - it's momentarily turned off when electric trim thumb switches on the yoke are pressed.

And they switched it back on because they couldn't manually re-trim due to very high speed that the plane was travelling at that point.

BTW the airplane was a 737 Max, not 737-NG.

> BTW the airplane was a 737 Max, not 737-NG.

I believe the parent's point was that they did what would have made sense in the NG, not realizing it wouldn't have the same result in a Max.

Note that the quote said it was a "contributing" (i.e. proximate) cause, not the root cause.

Anecdote - After TMI the NRC mandated that all nuclear plants install a system to automatically initiate auxiliary feed water to the steam generators if certain criteria were met. The Combustion Engineering version of this was called Aux Feed Actuation System or AFAS. During the next refueling outage it was being installed and I was giving lectures on it's design and operation (I had moved from operations to training by then) and the very first question from the very first operator training session was "How do you turn it off". My answer was "you can't". They were not happy.

Reply on news.ycombinator.com