6 ms·

Money quote is as the end, from a Max pilot: “Tecce did not fault the FAA for taking a wait-and-see approach. “A lot of people throwing a lot of rocks at the F

Money quote is as the end, from a Max pilot: “Tecce did not fault the FAA for taking a wait-and-see approach. “A lot of people throwing a lot of rocks at the FAA. Since 2010 we’ve had one aviation fatality” in the United States. “Our safety record is astonishing,” he said. “I don’t think there’s anything wrong with the airplane. If you talk to the pilots who fly them, they’ll tell you it’s not the airplane so much as whether or not the manual properly describes what’s going on.”” Seems more and more consensus is forming around this idea, that the MCAS system generally did what it was supposed to do, _and_ has an appropriate safety cutoff for the pilot if needed, but that Boeing did not focus a lot of attention on this new system in their training/documentation when in fact they needed to.

cjbprime 8y ago
The entire world focused attention on the new system after the Lion Air crash, and it was not enough to stop the Ethiopian Airlines crash from happening. The FAA thinks it's likely that the crashes are related.
- linuxftw 8y ago
  I don't think they had the altitude to recover, if it was even a recoverable MCAS issue to begin with.
  - cjbprime 8y ago
    I think they did -- it looks like it took six minutes from the first distress call claiming a control issue (at 7000ft) to impact, and they stayed at around 7000ft for much of those six minutes.
    - linuxftw 8y ago
      You're confused as the information is not widely available. That's 7k ft about sea level. From [1]: > The aircraft climbed very slowly and only to about 1,000ft above ground before crashing. https://leehamnews.com/2019/03/15/bjorns-corner-the-ethiopian-airlines-flight-302-crash/ https://leehamnews.com/2019/03/15/bjorns-corner-the-ethiopia...
      - cjbprime 8y ago
        Thanks, I see. Still, around six minutes seems a decent amount of time to fix a flight control problem once you know about it?
        SomeHacker44 8y ago
        Clearly not, as they did not.
rixrax 8y ago
Discussion online and otherwise about these two accidents focus almost 100% around MCAS and angle of attack (AoA) sensor malfunction + pilot 'error' [due to insufficient training]. For the sake of further speculation: what are the chances that in-fact there would be some other contributing factor or indeed a root cause (where MCAS no doubt maybe plays part) that was missed by Lion air incident analysis. Assuming of course that both incidents would have same / similar root cause.
- hencq 8y ago
  Just saw this after I commented, but I think the chances of that are quite high. I would imagine pilot error is somewhat less likely since so much attention was drawn to MCAS after the Lion Air flight.
- ams6110 8y ago
  I have seen some suggestion that in the Ethopian crash the crew may have overlooked setting the flaps for takeoff. This would not only reduce lift but also potentially allow MCAS to operate since it only works with flaps retracted. Let me say again this is only speculation as far as I have seen.
  - CydeWeys 8y ago
    Surely there's some kind of warning system that alerts if the flaps aren't set for take-off?! That'd be easy to write an alert for -- are the wheels-down sensors triggered, the throttle well above idle, and the flaps up? Fire the alert.
  - rixrax 8y ago
    My armchair speculation finds it odd that there is no more discussion around unusually high airspeed and what is causing them early in the flight. E.g. it appears that both JT610 and ET302 hit ~300kts within ~2 minutes of flight[0][1] whereas on problem free takeoffs 300kts appears to be reached at ~4 minutes into the flight at around 10k ft[3][4][5]. So based on this, I would speculate that maybe there is some condition that leads to run-away thrust, makes pilots report 'flight control problem' about 3 minutes into the flight[5][6] and then the rest follows. If the angle suggested above has already been investigated and there is some reporting around this - would appreciate pointer there. [0] https://www.flightradar24.com/data/flights/et302#1fc0cdb5 https://www.flightradar24.com/data/flights/et302#1fc0cdb5 (ET302) [1] https://www.flightradar24.com/data/pinned/jt610-1e5ff318#1e5ff318 https://www.flightradar24.com/data/pinned/jt610-1e5ff318#1e5... (JT610) [2] https://www.flightradar24.com/data/flights/aa2405#1fbc9d44 https://www.flightradar24.com/data/flights/aa2405#1fbc9d44 (AA2405) [3] https://www.flightradar24.com/data/flights/wn2389#1fbd2039 https://www.flightradar24.com/data/flights/wn2389#1fbd2039 (WN2390) [4] https://www.flightradar24.com/data/flights/et302#1fbe5988 https://www.flightradar24.com/data/flights/et302#1fbe5988 (ET302 on Mar 9th) [5] https://en.wikipedia.org/wiki/Lion_Air_Flight_610 https://en.wikipedia.org/wiki/Lion_Air_Flight_610 [6] https://www.reuters.com/article/us-ethiopia-airplane/ethiopia-sends-boeing-black-boxes-abroad-norway-airline-wants-compensation-idUSKBN1QU15W https://www.reuters.com/article/us-ethiopia-airplane/ethiopi...
briatx 8y ago
Even if training would have prevented the crashes it's still bad design for a critical change in flight control. Computers should never overrule manual controls. If the autopilot is on and the pilot makes an manual adjustment to the yoke, the autopilot shuts off. They should have designed the MCAS system to recognize when the pilot was fighting it and to disable itself. It's like the runaway Prius problem. Turning off the car might be considered an appropriate safety cutoff, but not everyone thinks of that in an emergent crisis.
- Obi_Juan_Kenobi 8y ago
  > Computers should never overrule manual controls. I think the justification for an AoA override is there; the system was created as a result of a history of pilot error. And having to disable a switch isn't overly burdensome. The issue seems to be transparency, letting the pilots know what the system is doing so they can make a judgement to disable it.
  - CydeWeys 8y ago
    It also needs to use three separate AoA sensors so it can detect a single malfunctioning sensor and discard its input. A system so critical, that can point the nose down and potentially cause crashes, needs more hardware redundancy in its inputs.
- losvedir 8y ago
  > They should have designed the MCAS system to recognize when the pilot was fighting it and to disable itself. Well "fighting" sort of begs the question, but the MCAS system was by design supposed to only activate in tandem with a pilot's actions, so it can't really work like an autopilot. It supplied stabilizer trim while the pilot was controlling the plane in order to make the ascent feel the same as the older 737's, since the different engine position on the Max 8 would otherwise make it behave differently.
  - briatx 8y ago
    > Well "fighting" sort of begs the question For instance, if the computer is attempting to pitch the plane down, while the pilot has the yoke all the way back. It should be possible to detect without too much mind reading.
Obi_Juan_Kenobi 8y ago
The takeaway I'm getting form all of this is that the system functionality is fine, but the operation is too obscure. There should be a design intention to communicate information to the pilot as clearly as possible, for automatic systems or otherwise. Relying on training alone for pilots to interpret this failure hasn't worked. It's too much of a blackbox if pilots can't quickly learn how the system is operating, e.g. how it operates when autopilot is on or off.
- thatswrong0 8y ago
  And they should have the MCAS rely on two AoA sensors and deactivate when there’s disagreement or perhaps ring a warning. IIRC Southwest Max’s have something like that, but it’s not a factory default (which is astonishing to me)
  - outworlder 8y ago
    Southwest only has the 'AoA disagree' indicator, for pilot awareness. But it doesn't change the operation of MCAS itself.
  - CydeWeys 8y ago
    It needs 3 sensors. If there's 2 sensors when you detect disagreement you can't safely do anything, even if it is warranted (e.g. if the AoA data showing 'good' is what's faulty). With 3 sensors you can discard just one bad sensor and continue flying safely, and then repair the broken sensor after the flight. Note that modern aircraft have 3 pitot tubes for precisely this reason. If AoA sensors are going to be so important too, then there also need to be 3 of them.
    - thatswrong0 8y ago
      Oh yeah totally agreed, I was just thinking that the 737 MAXs currently only have 2 installed so that’s what they could work with without an even greater retrofit.
      - 8y ago
LoSboccacc 8y ago
recovery procedures are developed under certain conditions within certain assumptions, see for example the laudair 004: the recovery procedure couldn't have ever worked under the condition three plane was into. just that they exists doesn't mean they work. doesn't mean they don't either so the safest bet is to wait for the investigations.
zerkten 8y ago
> If you talk to the pilots who fly them, they’ll tell you it’s not the airplane so much as whether or not the manual properly describes what’s going on How much effort goes into updates to manuals and training between new versions of aircraft? Does the regulator mandate particular updates, or retraining?
skywhopper 8y ago
But the FAA is partially responsible for the contents of the manual. These crashes were outside their jurisdiction but many pilots were surprised to hear about this system when it was revealed after the first crash.
ken 8y ago
> "Since 2010 we’ve had one aviation fatality" in the United States That doesn't sound right to me at all. - In 2014, 2 people were killed when a helicopter crashed in downtown Seattle. According to [1], that wasn't even the only news aircraft fatality in the USA in the past 5 years. - UPS Airlines Flight 1354 (2013) killed 2 people, so we've had more than one commercial airplane fatality this decade, too. - I assume they're ignoring the Q400 incident (really in no way the FAA's fault), and my first guess was that they mean "no passenger fatalities on a commercial jet in the US", which could then be referring to Southwest Airlines Flight 1380 (2018) -- but Asiana Airlines Flight 214 (2013) had 3 fatalities. So I'm really not sure what they mean by this claim. Any way I slice it, there's definitely been more than one. [1]: https://en.wikipedia.org/wiki/List_of_news_aircraft_accidents_and_incidents https://en.wikipedia.org/wiki/List_of_news_aircraft_accident...
oarsinsync 8y ago
I'm not actually convinced that Fred Tecce, "Commercial pilot and aviation expert" has actually flown the Max himself. The quote you've used also is interestingly phrased: "If you talk to the pilots who fly them", because it seems he might not be one of them. Instead, he's described as a "commercial aviation expert" who is defending the FAA. Possibly (un)related, he used to be a federal prosecutor.

cjbprime 8y ago

The entire world focused attention on the new system after the Lion Air crash, and it was not enough to stop the Ethiopian Airlines crash from happening. The FAA thinks it's likely that the crashes are related.

linuxftw 8y ago
I don't think they had the altitude to recover, if it was even a recoverable MCAS issue to begin with.
- cjbprime 8y ago
  I think they did -- it looks like it took six minutes from the first distress call claiming a control issue (at 7000ft) to impact, and they stayed at around 7000ft for much of those six minutes.
  - linuxftw 8y ago
    You're confused as the information is not widely available. That's 7k ft about sea level. From [1]: > The aircraft climbed very slowly and only to about 1,000ft above ground before crashing. https://leehamnews.com/2019/03/15/bjorns-corner-the-ethiopian-airlines-flight-302-crash/ https://leehamnews.com/2019/03/15/bjorns-corner-the-ethiopia...
    - cjbprime 8y ago
      Thanks, I see. Still, around six minutes seems a decent amount of time to fix a flight control problem once you know about it?
      - SomeHacker44 8y ago
        Clearly not, as they did not.

rixrax 8y ago

Discussion online and otherwise about these two accidents focus almost 100% around MCAS and angle of attack (AoA) sensor malfunction + pilot 'error' [due to insufficient training]. For the sake of further speculation: what are the chances that in-fact there would be some other contributing factor or indeed a root cause (where MCAS no doubt maybe plays part) that was missed by Lion air incident analysis. Assuming of course that both incidents would have same / similar root cause.

hencq 8y ago
Just saw this after I commented, but I think the chances of that are quite high. I would imagine pilot error is somewhat less likely since so much attention was drawn to MCAS after the Lion Air flight.
ams6110 8y ago
I have seen some suggestion that in the Ethopian crash the crew may have overlooked setting the flaps for takeoff. This would not only reduce lift but also potentially allow MCAS to operate since it only works with flaps retracted. Let me say again this is only speculation as far as I have seen.
- CydeWeys 8y ago
  Surely there's some kind of warning system that alerts if the flaps aren't set for take-off?! That'd be easy to write an alert for -- are the wheels-down sensors triggered, the throttle well above idle, and the flaps up? Fire the alert.
- rixrax 8y ago
  My armchair speculation finds it odd that there is no more discussion around unusually high airspeed and what is causing them early in the flight. E.g. it appears that both JT610 and ET302 hit ~300kts within ~2 minutes of flight[0][1] whereas on problem free takeoffs 300kts appears to be reached at ~4 minutes into the flight at around 10k ft[3][4][5]. So based on this, I would speculate that maybe there is some condition that leads to run-away thrust, makes pilots report 'flight control problem' about 3 minutes into the flight[5][6] and then the rest follows. If the angle suggested above has already been investigated and there is some reporting around this - would appreciate pointer there. [0] https://www.flightradar24.com/data/flights/et302#1fc0cdb5 https://www.flightradar24.com/data/flights/et302#1fc0cdb5 (ET302) [1] https://www.flightradar24.com/data/pinned/jt610-1e5ff318#1e5ff318 https://www.flightradar24.com/data/pinned/jt610-1e5ff318#1e5... (JT610) [2] https://www.flightradar24.com/data/flights/aa2405#1fbc9d44 https://www.flightradar24.com/data/flights/aa2405#1fbc9d44 (AA2405) [3] https://www.flightradar24.com/data/flights/wn2389#1fbd2039 https://www.flightradar24.com/data/flights/wn2389#1fbd2039 (WN2390) [4] https://www.flightradar24.com/data/flights/et302#1fbe5988 https://www.flightradar24.com/data/flights/et302#1fbe5988 (ET302 on Mar 9th) [5] https://en.wikipedia.org/wiki/Lion_Air_Flight_610 https://en.wikipedia.org/wiki/Lion_Air_Flight_610 [6] https://www.reuters.com/article/us-ethiopia-airplane/ethiopia-sends-boeing-black-boxes-abroad-norway-airline-wants-compensation-idUSKBN1QU15W https://www.reuters.com/article/us-ethiopia-airplane/ethiopi...

briatx 8y ago

Even if training would have prevented the crashes it's still bad design for a critical change in flight control. Computers should never overrule manual controls. If the autopilot is on and the pilot makes an manual adjustment to the yoke, the autopilot shuts off. They should have designed the MCAS system to recognize when the pilot was fighting it and to disable itself. It's like the runaway Prius problem. Turning off the car might be considered an appropriate safety cutoff, but not everyone thinks of that in an emergent crisis.

Obi_Juan_Kenobi 8y ago
> Computers should never overrule manual controls. I think the justification for an AoA override is there; the system was created as a result of a history of pilot error. And having to disable a switch isn't overly burdensome. The issue seems to be transparency, letting the pilots know what the system is doing so they can make a judgement to disable it.
- CydeWeys 8y ago
  It also needs to use three separate AoA sensors so it can detect a single malfunctioning sensor and discard its input. A system so critical, that can point the nose down and potentially cause crashes, needs more hardware redundancy in its inputs.
losvedir 8y ago
> They should have designed the MCAS system to recognize when the pilot was fighting it and to disable itself. Well "fighting" sort of begs the question, but the MCAS system was by design supposed to only activate in tandem with a pilot's actions, so it can't really work like an autopilot. It supplied stabilizer trim while the pilot was controlling the plane in order to make the ascent feel the same as the older 737's, since the different engine position on the Max 8 would otherwise make it behave differently.
- briatx 8y ago
  > Well "fighting" sort of begs the question For instance, if the computer is attempting to pitch the plane down, while the pilot has the yoke all the way back. It should be possible to detect without too much mind reading.

Obi_Juan_Kenobi 8y ago

The takeaway I'm getting form all of this is that the system functionality is fine, but the operation is too obscure. There should be a design intention to communicate information to the pilot as clearly as possible, for automatic systems or otherwise. Relying on training alone for pilots to interpret this failure hasn't worked. It's too much of a blackbox if pilots can't quickly learn how the system is operating, e.g. how it operates when autopilot is on or off.

thatswrong0 8y ago
And they should have the MCAS rely on two AoA sensors and deactivate when there’s disagreement or perhaps ring a warning. IIRC Southwest Max’s have something like that, but it’s not a factory default (which is astonishing to me)
- outworlder 8y ago
  Southwest only has the 'AoA disagree' indicator, for pilot awareness. But it doesn't change the operation of MCAS itself.
- CydeWeys 8y ago
  It needs 3 sensors. If there's 2 sensors when you detect disagreement you can't safely do anything, even if it is warranted (e.g. if the AoA data showing 'good' is what's faulty). With 3 sensors you can discard just one bad sensor and continue flying safely, and then repair the broken sensor after the flight. Note that modern aircraft have 3 pitot tubes for precisely this reason. If AoA sensors are going to be so important too, then there also need to be 3 of them.
  - thatswrong0 8y ago
    Oh yeah totally agreed, I was just thinking that the 737 MAXs currently only have 2 installed so that’s what they could work with without an even greater retrofit.
    - 8y ago

LoSboccacc 8y ago

recovery procedures are developed under certain conditions within certain assumptions, see for example the laudair 004: the recovery procedure couldn't have ever worked under the condition three plane was into. just that they exists doesn't mean they work. doesn't mean they don't either so the safest bet is to wait for the investigations.

zerkten 8y ago

> If you talk to the pilots who fly them, they’ll tell you it’s not the airplane so much as whether or not the manual properly describes what’s going on How much effort goes into updates to manuals and training between new versions of aircraft? Does the regulator mandate particular updates, or retraining?

skywhopper 8y ago

But the FAA is partially responsible for the contents of the manual. These crashes were outside their jurisdiction but many pilots were surprised to hear about this system when it was revealed after the first crash.

ken 8y ago

> "Since 2010 we’ve had one aviation fatality" in the United States That doesn't sound right to me at all. - In 2014, 2 people were killed when a helicopter crashed in downtown Seattle. According to [1], that wasn't even the only news aircraft fatality in the USA in the past 5 years. - UPS Airlines Flight 1354 (2013) killed 2 people, so we've had more than one commercial airplane fatality this decade, too. - I assume they're ignoring the Q400 incident (really in no way the FAA's fault), and my first guess was that they mean "no passenger fatalities on a commercial jet in the US", which could then be referring to Southwest Airlines Flight 1380 (2018) -- but Asiana Airlines Flight 214 (2013) had 3 fatalities. So I'm really not sure what they mean by this claim. Any way I slice it, there's definitely been more than one. [1]: https://en.wikipedia.org/wiki/List_of_news_aircraft_accidents_and_incidents https://en.wikipedia.org/wiki/List_of_news_aircraft_accident...

oarsinsync 8y ago

I'm not actually convinced that Fred Tecce, "Commercial pilot and aviation expert" has actually flown the Max himself. The quote you've used also is interestingly phrased: "If you talk to the pilots who fly them", because it seems he might not be one of them. Instead, he's described as a "commercial aviation expert" who is defending the FAA. Possibly (un)related, he used to be a federal prosecutor.