11 ms·

Preliminary conclusion MCAS misfired in Ethiopian's 737 max crash

121 points by leemailll 8y ago

VBprogrammer 8y ago
That's not very surprising to anyone who has been following along. The more interesting question is why they failed to identify the trim runaway condition, or if they did indeed identify it, why the procedure failed to correct it? This is significantly different to the Lion air incident where you can easily give the pilots the benefit of the doubt because the failure mode hadn't been previously identified. The details of MCAS and the procedure to handle it was communicated to all operators months before this accident.
- tapland 8y ago
  Maybe time was an issue? Saw in an earlier post that the issue had to be mitigated within 40 seconds of it occurring.
  - sokoloff 8y ago
    40 seconds is an eternity to accomplish the memory items on runaway stab trim non-normal checklist. It’s literally “control column - hold firmly” (already a given, since MCAS only affects manual flight and the increased back pressure required is the cue that something is amiss), “autopilot and autothrottle - disengage” (click-click, click-click), (if runaway continues) “stab trim cutout switches - cutout (both)”, (if runaway continues) “trim wheel x grasp and hold” All of those are “above the line, memory items” which the crew must be able to recall and execute prior to referencing the checklists in the QRH. Boeing has some significant fault here, but I’d expect a full performance crew to handle this emergency and suspect the CVR and FDR data will show them in a less than fully flattering light, especially after Lion Air, the emergency AD, safety memos, and general publicity surrounding the previous crash.
    - dba7dba 8y ago
      Main stream media made it sound like 40 seconds is way too short of a time to troubleshoot the issue. But now that you state it that way, I gotta agree with you it's not Only Boeings fault. Sure they are big significant part of the issue. But not the only part.
      - chopin 8y ago
        40s is only enough if you know what to do right away from the start of the situation. A failing sensor may confront the pilots with many (unrelated to a trim runaway) warnings (like unreliable airspeed, stick shaker, alt disagree). That has been the case for Lion Air at least.
        sokoloff 8y ago
        Take a car analogy. Suppose your car starts drifting into oncoming traffic. Maybe the road crown changed, maybe your alignment changed from a debris strike, maybe you have a tire going down, maybe you have a crosswind. In all those cases, your reaction is the same and instinctive regardless of whether or not you know the root cause. Flying an airplane manually on instruments, the pilot sees the airplane undershooting the pitch target and pulls back on the control column every bit as naturally as the car driver above. When the pitch target is correct and the control force high, use the stab trim to take the force away. This is every bit as much a continual process as the driver lane keeping. If MCAS is trimming against you every time you let go of the trim, you get feedback that this is likely a trim issue. Keep flying the airplane and trimming as needed. This is not a case where the airplane automation fails and an airplane suddenly gets “dumped” onto a pilot who has to regain control and figure things out. It’s obvious that the time and space available was not enough for that Lion Air or that Ethiopian Air flight, so you have real world evidence to support your point. I acknowledge that fact, of course.
      - karlkatzke 8y ago
        As someone who's done a bunch of human factors design training for critical situations in a previous career as a UI/UX designer and now works as a systems engineer doing a bunch of alerting, 40 seconds is too short of a time to troubleshoot the issue. When this situation happens, five things happen at once. MASTER CAUTION (whoop, whoop noises and a big red light!), ALT DISAGREE alert on the MFD, Incorrect Airspeed on the MFD, the stick shaker goes off, and by the way, if you take the time to look down at the throttle section of the dashboard with all those other alerts going off, you'd see that there is suddenly a lot of trim on the APL trim indicator but the trim wheel doesn't actually move (which would provide an audible 'click click click' that would probably trigger that there was a problem with trim. Each of those things has a separate memory checklist that you have to run down, and subtract ten seconds to register them, prioritize, communicate with the other pilot, and start executing them. The worst part here is that they've added another alert and then changed how the airplane will fly in the middle of an emergency. While the extra alert narrows down the number of branches from the "prioritization" part of the checklist, I'm not sure that's "fixing" the problem.
  - cm2187 8y ago
    I am not talking about these specific pilots about which I know nothing. But not every single commercial pilot is passionate about his job. For some it is just a day job and until they are asked to do a particular training, may not even be aware that MCAS even exists. Think professional developers (granted the bar is infinitely lower). You would assume no one would introduce a SQL injection vulnerability in new code given all we know and all that happened. Well... Also some commercial pilot on HN provided another element of answer. When you are in an emergency situation, you don't have the time to sit back and think, you revert to experience, muscle memory and training. Even if it may have crossed these guys mind that it was the same problem than Lion air, they may not necessarily know the procedure to fix it while trying to keep the plane from crashing at the same time. Just speculating.
    - VBprogrammer 8y ago
      That would be a huge failing on behalf of the airline. There was an emergency airworthiness directive which should have brought this to the attention to all pilots of these aircraft even if they somehow missed all of the other coverage.
      - chopin 8y ago
        But this directive said "handle like a trim runaway". However MCAS may present itself differently from a trim runaway when failing. Furthermore a failing sensor may activate the stick shaker and the last thing a pilot is trained to do is pull up in such a situation. So you might get: - unreliable airspeed warning - stick shaker (=stall is imminent) So you don't know your airspeed (otherwise you can conclude you're safe for your current pitch and vertical speed) and a stall warning. The last thing you do is to look for horizontal trim.
        VBprogrammer 8y ago
        The full list of potential indications is included in the AD. It also describes the operation of the trim system under MCAS control. You can see them in the Lion Air preliminary report linked above. Pilots are trained to deal with partial panel situations. The mantra is pitch + power = performance. In VMC this should be well within the capibilities of a normal pilot, put the nose on the horizon and set something like 65% power.
  - in_cahoots 8y ago
    That 40 second quote is a bit misleading. As I understand it, if the pilots do absolutely nothing then they only have 40 seconds until MCAS has adjusted the trim the maximum amount. But the Lion Air flight flew for several minutes with the MCAS firing; the pilot manually counter-intervened each time. It was only when he handed control to a co-pilot that the plane nosedived. Theoretically they could have flown indefinitely while they debugged the problem.
    - Rooster61 8y ago
      > Theoretically they could have flown indefinitely while they debugged the problem. Not true. From what I have read, MCAS runs in 10 second intervals, with the amount of trim added increasing with each successive run. Once the trim has reached a certain point, it over-powers the amount of control the pilot has by putting pressure on the yoke (this controls elevators, which have less overall influence on the aircraft than the trim at full bore). We know that the pilots on the previous flight with the 3rd deadheading pilot were attempting to right the plane using yoke pressure, and at one point the first officer mentioned that the yoke was "too heavy to hold back". That indicates that MCAS had pushed the trim past the point at which the pilots could physically overcome it's influence using the elevators. (source here: https://www.reuters.com/article/us-ethiopia-airplane-regulator-insight/regulators-knew-before-crashes-that-737-max-trim-control-was-confusing-in-some-conditions-document-idUSKCN1RA0DP https://www.reuters.com/article/us-ethiopia-airplane-regulat...)
      - VBprogrammer 8y ago
        The pilot can run the trim in the other direction using the normal switches on the yoke. You can see that if you look at the trim position graph in the Lion Air accident. For some reason before the crash the pattern of repeatedly correcting changes, possibly because he handed control to the first officer.
        Rooster61 8y ago
        "The undated EASA certification document, available online, was issued in February 2016, an agency spokesman said. It specifically noted that at speeds greater than 230 knots (265mph, 425kph) with flaps retracted, pilots might have to use the wheel in the cockpit’s center console rather than an electric thumb switch on the control yoke. " So, yes and no. It gives SOME control over the trim, but if the trim keeps getting bumpped progressively higher by the MCAS, it will eventually outstrip the yoke control. My guess is that that change you mentioned is the threshold at which their yoke trim control became insufficient.
  - deleted 8y ago
    [deleted]
- snarf21 8y ago
  A major factor in this is that they were told that this plane flies exactly the same as the previous 737. If you do the same "right" things you always do, how are supposed to know things are going badly when you've been lied to from the jump?
mysterydip 8y ago
"Instead of relying on a single sensor indicating the angle of the plane’s nose, MCAS will rely on data from both of the plane’s sensors" Why wouldn't you design it that way from the beginning? This isn't Boeing's first plane.
- kristofferR 8y ago
  They did, but the redundancy was a premium add-on feature.
  - Moru 8y ago
    No, the extra sensor was add-on feature. It still wasn't redundant for the MCAS, just an indicator for the pilots.
    - kristofferR 8y ago
      Wow, that's even worse...
    - mhandley 8y ago
      All 737s have two AoA sensors - they're used for several purposes, not just MCAS. Originally MCAS used only one of the two sensors, though it alternated which one with each flight. The optional features were an AoA disagree indicator, and the AoA data itself being displayed on the cockpit displays. Having either optional feature didn't change the fact that MCAS only used one sensor.
- mhandley 8y ago
  Because if you did that, you'd have to alert the pilots when the AoA sensors disagree and MCAS has been disabled. And you can't do that without training them on what that means, notably how the plane will now fly differently with what you might call "relaxed stability" at high angles of attack. And Boeing really really wanted to avoid retraining of pilots because apparently they had a contract with SouthWest that would cost then $1M per plane if retraining was required.
marksomnian 8y ago
Paywalled, anyone have a workaround?
- kmetan 8y ago
  Not a workaround, but I think all important info is here: https://www.cnbc.com/2019/03/29/ethiopian-crash-boeing-737-max-anti-stall-system-likely-activatedwsj.html https://www.cnbc.com/2019/03/29/ethiopian-crash-boeing-737-m...
- jkh1 8y ago
  Different article: https://www.bbc.com/news/business-47745191 https://www.bbc.com/news/business-47745191
- 1f60c 8y ago
  Simply search for the title on Google, and they’ll let you in based on that. https://www.google.com/search?q=Investigators+Believe+Boeing+737+MAX+Stall-Prevention+Feature+Activated+in+Ethiopian+Crash https://www.google.com/search?q=Investigators+Believe+Boeing...
  - mastazi 8y ago
    The little "web" link under the title of every HN post does that for you :-)
    - sundvor 8y ago
      Oh didn't know that one - thanks!
    - alistairSH 8y ago
      It does the search for you, but WSJ is paywalled even in private browser sessions. But, there are other sources for this particular topic, as it's covered extensively by the MSM.
  - obituary_latte 8y ago
    This didn’t work for me (neither did the “web” link under op title). Wonder if it was because I’d already visited?
sheeshkebab 8y ago
As an airplane passenger that’s mostly amazed at butt’s ability to fly 10km up in the air while I’m enjoying peanuts and listening to music, I’m going say it’s a good thing that an extra MCASH, or whatever it is, is a good thing. And I know what I’m talking about.
armitron 8y ago
I'll never fly 737 Max. No matter what changes they do, barring a complete redesign of the plane. Boeing deserves to go out of business for this.
- chasingthewind 8y ago
  I'm not going to defend Boeing's conduct here for one moment, but I do think your statement is an over-reaction. The company employs 150,000 people, it contributes billions to the US economy, and builds significant aerospace know-how in the US. I imagine we could come up with lots of reasons why Boeing is a net positive. These crashes are tragic and Boeing's conduct deserves condemnation, but a solution that keeps the company going and fixes the culture that led to this seems to be a far better solution than them going out of business entirely.
  - fopen64 8y ago
    If I pack air, sell it as panacea, and employ 150k people doing that, do I deserve to be be in business?
    - salex89 8y ago
      If you can actually pay 150k people, maybe you do, since you're bloody good at it! Joke aside, let's be fair, Boeing did not sell air. Their greed got the better of them, and the institutions set to prevent that did not do their job. They should take responsibility for the things they did (or in this case, did not). There is no penalty high enough to bring back lives.
      - rubinelli 8y ago
        I wish there was a law to nationalize a company that was found guilty of gross negligence, to subsequently pay damages and re-sell them in the market. Make shareholders accountable, instead of sending a couple of middle managers to jail and keeping the same incentives that caused the first tragedy in place.
linuxftw 8y ago
Still doesn't answer the question of, why if MCAS is required during critical portions of the flight to prevent stalling is disabling of MCAS an acceptable solution for this aircraft? Introducing a new condition of "We think MCAS is on, but we're not quite sure / it's cutting in and out due to censor disagreements" is preposterous.
- ams6110 8y ago
  This might be splitting hairs, but MCAS is not there to prevent stalling. It's there to meet a specific certification requirement on control stick forces at high angles of attack. Yes the intent of the requirement is to reduce the tendency of the pilot to pitch up too much near the stall. But MCAS doesn't prevent stalling. Modern aircraft have many automatic systems that are there to make the pilot's job easier. That doesn't mean they are unsafe to fly if those systems malfunction and have to be disabled.
  - linuxftw 8y ago
    Every source I've found refers to it as an anti stall system, and the system is designed to limit angle of attack (eg, prevent the system from stalling). It's definitely a safety feature that's required and not an assistive device. It was required for certification, and in fact as originally specified was unsuitable to prevent stalls, so Boeing had to increase the authority of the system to make it functional.
tomnm 8y ago
Physics cannot be fixed by software. The necessity of MCAS means the airframe has fatal flaws. I would avoid 737 Max by all means, no matter whatever software revisions Boeing releases. Previous discussions: https://news.ycombinator.com/item?id=19509618 https://news.ycombinator.com/item?id=19509618
- wp381640 8y ago
  most modern fighter jets would drop out of the sky like a rock without software they'll eventually get this right - they just need to step back and recognise that the MAX is a completely new type of aircraft and stop taking shortcuts on certification and training what saves them is that Airbus is at production capacity on the neo
  - yardie 8y ago
    I wouldn't hold fighter jets up as an example of safety. They spend more time broken then they do operational. Require a an entire team of engineers for each airframe, and the number of pilot deaths/flight time is pretty atrocious. But since it's 1-2 pilot deaths rather than >100 passengers we put up with it. A well designed aircraft should not have a single point of failure, including the software.
  - bobowzki 8y ago
    While it's true that fighter jets have been aerodynamically unstable for decades, they're not built for transportation and have ejection seats. The main reason they are unstable is to increase agility. Is this necessary or even wanted in passenger aviation? I don't know but I'd guess not. Probably safety, comfort and fuel economy are far more important and can (should?) be achieved with a stable airframe.
    - wp381640 8y ago
      fighter jets are the more extreme and established example, it also applies to most modern airliners which have software systems in place to prevent human controls from exceeding the aircraft flight envelope fuel efficiency in these modern aircraft has been gained with swept back wings, larger intake engines etc. which with direct control and no software would be almost impossible to keep flying discarding all of these systems because of a problem with one would set airline safety and efficiency back decades
just_steve_h 8y ago
Here's the design decision that puzzles me the most: MCAS commands nose-down trim. The pilot uses the trim button on the yoke to command nose-up trim. Why isn't that enough to disable MCAS and cause an audible alert? Think of an analogy: when the autopilot commands a nose-down elevator input, and the pilot pulls back on the control column, that's enough to disengage the autopilot. Or think of cruise control in a car: if the computer commands acceleration, and the driver steps on the brake, cruise control disengages. The necessity of MCAS is to meet regulatory requirements for similarity in handling characteristics to achieve a common type rating. It's not strictly an engineering requirement, nor is it a safety-assisting technology. It's an attempt to mask the actual aerodynamic characteristics of the aircraft being flown. That is a conflicting mission if you will.
- wp381640 8y ago
  > Why isn't that enough to disable MCAS From what I understand it did but it would reengage again. It's the reason why the Lion Air flight lasted longer in the air than Ethiopian, because the pilots in that case kept hitting the trim and buying themselves 40-60 seconds each time
  - oflannabhra 8y ago
    Yep, and on top of that the 737 MAX did not require retraining for pilots (cost savings for Boeing and airlines) and Boeing did not provide documentation to pilots that MCAS would re-engage after a short timeout. Pilots use the term "ahead of the plane" to describe being in a state where they understand exactly how a plane and its systems will respond to inputs (including theirs). MCAS (and lack of training) resulted in pilots being "behind the plane", which meant they could not regain control over the plane and ultimately crashed.
  - briandear 8y ago
    They could have disabled the whole thing if they simply followed the standard runaway trim procedure. A system malfunction should appear to a pilot the same way a runaway trim wheel appears. The result is that there is runaway trim checklist—and a procedure to work around it. You turn off the electric trim and go to a manual reversion. It’s something every 737 pilot trains for. Here’s some discussion about this from 2009: https://www.airliners.net/forum/viewtopic.php?t=761011 https://www.airliners.net/forum/viewtopic.php?t=761011 Even if the cause is an MCAS failure, the way that failure presents in the cockpit follows the same procedures as runaway trim: which means to me that the Ethiopian and Lion Air pilots were simply under-trained. The 200 total hours of the Ethiopian first officer supports that assertion. In the US, a first officer has a 1500 hour requirement: having a 200 hour pilot in the cockpit can’t be ignored as a contributing cause especially since following the standard checklists would have saved the plane— if the first officer would have known to consult those checklists. In the US, you can’t even fly Cessnas commercially with 200 hours and this first officer was copiloting a modern 737.
bdavis__ 8y ago
The amount of Boeing hate is phenomenal. "scrap the plane" ! "require a new type certificate" "never fly in a 737 max, no matter what". Boeing made a plane that conformed to all rules and regulations. As part of the design process, they made many, many tradeoff's. What kind of fastener goes on this panel? How often does this data go across the data bus? What material is used for this cable? Literally thousands of them. Not every one , by itself is safety critical; but many of them can turn out to be. The MCAS design was not some engineer skirting the law, or wanting to kill people, or even disinterested in safety. It was a compromise design of cost vs safety; in hindsight it looks like the compromise was done poorly. A 100% safe airplane weighs too much to fly and costs too much to build. This means every design decision has to take into account other things than just 'raw safety'. They made a mistake. Even when you are not "moving fast and breaking things", people make mistakes. process adherence misses the mistake. And in this case people die. Unfortunately, that is how we improve aviation safety. With the blood of passengers and crew. Not on purpose, not because boeing is greedy, but because people make mistakes, systems fail, airplanes crash. This was not a single failure of the aviation safety system. N things had to happen for these crashes. And the system is going to fix each one of them, and do a humans best effort to change the process so it does not happen again. i would fly a Boeing aircraft tomorrow (yes, a 737 MAX 8). Or an Airbus. They are both built and overseen by the best our world has to offer. This is not the first design failure that has been the cause of an incident (or even a series of incidents) and it will not be the last.

121 points by leemailll 8y ago

That's not very surprising to anyone who has been following along. The more interesting question is why they failed to identify the trim runaway condition, or if they did indeed identify it, why the procedure failed to correct it? This is significantly different to the Lion air incident where you can easily give the pilots the benefit of the doubt because the failure mode hadn't been previously identified. The details of MCAS and the procedure to handle it was communicated to all operators months before this accident.

tapland 8y ago
Maybe time was an issue? Saw in an earlier post that the issue had to be mitigated within 40 seconds of it occurring.
- sokoloff 8y ago
  40 seconds is an eternity to accomplish the memory items on runaway stab trim non-normal checklist. It’s literally “control column - hold firmly” (already a given, since MCAS only affects manual flight and the increased back pressure required is the cue that something is amiss), “autopilot and autothrottle - disengage” (click-click, click-click), (if runaway continues) “stab trim cutout switches - cutout (both)”, (if runaway continues) “trim wheel x grasp and hold” All of those are “above the line, memory items” which the crew must be able to recall and execute prior to referencing the checklists in the QRH. Boeing has some significant fault here, but I’d expect a full performance crew to handle this emergency and suspect the CVR and FDR data will show them in a less than fully flattering light, especially after Lion Air, the emergency AD, safety memos, and general publicity surrounding the previous crash.
  - dba7dba 8y ago
    Main stream media made it sound like 40 seconds is way too short of a time to troubleshoot the issue. But now that you state it that way, I gotta agree with you it's not Only Boeings fault. Sure they are big significant part of the issue. But not the only part.
    - chopin 8y ago
      40s is only enough if you know what to do right away from the start of the situation. A failing sensor may confront the pilots with many (unrelated to a trim runaway) warnings (like unreliable airspeed, stick shaker, alt disagree). That has been the case for Lion Air at least.
      - sokoloff 8y ago
        Take a car analogy. Suppose your car starts drifting into oncoming traffic. Maybe the road crown changed, maybe your alignment changed from a debris strike, maybe you have a tire going down, maybe you have a crosswind. In all those cases, your reaction is the same and instinctive regardless of whether or not you know the root cause. Flying an airplane manually on instruments, the pilot sees the airplane undershooting the pitch target and pulls back on the control column every bit as naturally as the car driver above. When the pitch target is correct and the control force high, use the stab trim to take the force away. This is every bit as much a continual process as the driver lane keeping. If MCAS is trimming against you every time you let go of the trim, you get feedback that this is likely a trim issue. Keep flying the airplane and trimming as needed. This is not a case where the airplane automation fails and an airplane suddenly gets “dumped” onto a pilot who has to regain control and figure things out. It’s obvious that the time and space available was not enough for that Lion Air or that Ethiopian Air flight, so you have real world evidence to support your point. I acknowledge that fact, of course.
    - karlkatzke 8y ago
      As someone who's done a bunch of human factors design training for critical situations in a previous career as a UI/UX designer and now works as a systems engineer doing a bunch of alerting, 40 seconds is too short of a time to troubleshoot the issue. When this situation happens, five things happen at once. MASTER CAUTION (whoop, whoop noises and a big red light!), ALT DISAGREE alert on the MFD, Incorrect Airspeed on the MFD, the stick shaker goes off, and by the way, if you take the time to look down at the throttle section of the dashboard with all those other alerts going off, you'd see that there is suddenly a lot of trim on the APL trim indicator but the trim wheel doesn't actually move (which would provide an audible 'click click click' that would probably trigger that there was a problem with trim. Each of those things has a separate memory checklist that you have to run down, and subtract ten seconds to register them, prioritize, communicate with the other pilot, and start executing them. The worst part here is that they've added another alert and then changed how the airplane will fly in the middle of an emergency. While the extra alert narrows down the number of branches from the "prioritization" part of the checklist, I'm not sure that's "fixing" the problem.
- cm2187 8y ago
  I am not talking about these specific pilots about which I know nothing. But not every single commercial pilot is passionate about his job. For some it is just a day job and until they are asked to do a particular training, may not even be aware that MCAS even exists. Think professional developers (granted the bar is infinitely lower). You would assume no one would introduce a SQL injection vulnerability in new code given all we know and all that happened. Well... Also some commercial pilot on HN provided another element of answer. When you are in an emergency situation, you don't have the time to sit back and think, you revert to experience, muscle memory and training. Even if it may have crossed these guys mind that it was the same problem than Lion air, they may not necessarily know the procedure to fix it while trying to keep the plane from crashing at the same time. Just speculating.
  - VBprogrammer 8y ago
    That would be a huge failing on behalf of the airline. There was an emergency airworthiness directive which should have brought this to the attention to all pilots of these aircraft even if they somehow missed all of the other coverage.
    - chopin 8y ago
      But this directive said "handle like a trim runaway". However MCAS may present itself differently from a trim runaway when failing. Furthermore a failing sensor may activate the stick shaker and the last thing a pilot is trained to do is pull up in such a situation. So you might get: - unreliable airspeed warning - stick shaker (=stall is imminent) So you don't know your airspeed (otherwise you can conclude you're safe for your current pitch and vertical speed) and a stall warning. The last thing you do is to look for horizontal trim.
      - VBprogrammer 8y ago
        The full list of potential indications is included in the AD. It also describes the operation of the trim system under MCAS control. You can see them in the Lion Air preliminary report linked above. Pilots are trained to deal with partial panel situations. The mantra is pitch + power = performance. In VMC this should be well within the capibilities of a normal pilot, put the nose on the horizon and set something like 65% power.
- in_cahoots 8y ago
  That 40 second quote is a bit misleading. As I understand it, if the pilots do absolutely nothing then they only have 40 seconds until MCAS has adjusted the trim the maximum amount. But the Lion Air flight flew for several minutes with the MCAS firing; the pilot manually counter-intervened each time. It was only when he handed control to a co-pilot that the plane nosedived. Theoretically they could have flown indefinitely while they debugged the problem.
  - Rooster61 8y ago
    > Theoretically they could have flown indefinitely while they debugged the problem. Not true. From what I have read, MCAS runs in 10 second intervals, with the amount of trim added increasing with each successive run. Once the trim has reached a certain point, it over-powers the amount of control the pilot has by putting pressure on the yoke (this controls elevators, which have less overall influence on the aircraft than the trim at full bore). We know that the pilots on the previous flight with the 3rd deadheading pilot were attempting to right the plane using yoke pressure, and at one point the first officer mentioned that the yoke was "too heavy to hold back". That indicates that MCAS had pushed the trim past the point at which the pilots could physically overcome it's influence using the elevators. (source here: https://www.reuters.com/article/us-ethiopia-airplane-regulator-insight/regulators-knew-before-crashes-that-737-max-trim-control-was-confusing-in-some-conditions-document-idUSKCN1RA0DP https://www.reuters.com/article/us-ethiopia-airplane-regulat...)
    - VBprogrammer 8y ago
      The pilot can run the trim in the other direction using the normal switches on the yoke. You can see that if you look at the trim position graph in the Lion Air accident. For some reason before the crash the pattern of repeatedly correcting changes, possibly because he handed control to the first officer.
      - Rooster61 8y ago
        "The undated EASA certification document, available online, was issued in February 2016, an agency spokesman said. It specifically noted that at speeds greater than 230 knots (265mph, 425kph) with flaps retracted, pilots might have to use the wheel in the cockpit’s center console rather than an electric thumb switch on the control yoke. " So, yes and no. It gives SOME control over the trim, but if the trim keeps getting bumpped progressively higher by the MCAS, it will eventually outstrip the yoke control. My guess is that that change you mentioned is the threshold at which their yoke trim control became insufficient.
- deleted 8y ago
  [deleted]
snarf21 8y ago
A major factor in this is that they were told that this plane flies exactly the same as the previous 737. If you do the same "right" things you always do, how are supposed to know things are going badly when you've been lied to from the jump?

mysterydip 8y ago

"Instead of relying on a single sensor indicating the angle of the plane’s nose, MCAS will rely on data from both of the plane’s sensors" Why wouldn't you design it that way from the beginning? This isn't Boeing's first plane.

kristofferR 8y ago
They did, but the redundancy was a premium add-on feature.
- Moru 8y ago
  No, the extra sensor was add-on feature. It still wasn't redundant for the MCAS, just an indicator for the pilots.
  - kristofferR 8y ago
    Wow, that's even worse...
  - mhandley 8y ago
    All 737s have two AoA sensors - they're used for several purposes, not just MCAS. Originally MCAS used only one of the two sensors, though it alternated which one with each flight. The optional features were an AoA disagree indicator, and the AoA data itself being displayed on the cockpit displays. Having either optional feature didn't change the fact that MCAS only used one sensor.
mhandley 8y ago
Because if you did that, you'd have to alert the pilots when the AoA sensors disagree and MCAS has been disabled. And you can't do that without training them on what that means, notably how the plane will now fly differently with what you might call "relaxed stability" at high angles of attack. And Boeing really really wanted to avoid retraining of pilots because apparently they had a contract with SouthWest that would cost then $1M per plane if retraining was required.

marksomnian 8y ago

Paywalled, anyone have a workaround?

kmetan 8y ago
Not a workaround, but I think all important info is here: https://www.cnbc.com/2019/03/29/ethiopian-crash-boeing-737-max-anti-stall-system-likely-activatedwsj.html https://www.cnbc.com/2019/03/29/ethiopian-crash-boeing-737-m...
jkh1 8y ago
Different article: https://www.bbc.com/news/business-47745191 https://www.bbc.com/news/business-47745191
1f60c 8y ago
Simply search for the title on Google, and they’ll let you in based on that. https://www.google.com/search?q=Investigators+Believe+Boeing+737+MAX+Stall-Prevention+Feature+Activated+in+Ethiopian+Crash https://www.google.com/search?q=Investigators+Believe+Boeing...
- mastazi 8y ago
  The little "web" link under the title of every HN post does that for you :-)
  - sundvor 8y ago
    Oh didn't know that one - thanks!
  - alistairSH 8y ago
    It does the search for you, but WSJ is paywalled even in private browser sessions. But, there are other sources for this particular topic, as it's covered extensively by the MSM.
- obituary_latte 8y ago
  This didn’t work for me (neither did the “web” link under op title). Wonder if it was because I’d already visited?

sheeshkebab 8y ago

As an airplane passenger that’s mostly amazed at butt’s ability to fly 10km up in the air while I’m enjoying peanuts and listening to music, I’m going say it’s a good thing that an extra MCASH, or whatever it is, is a good thing. And I know what I’m talking about.

armitron 8y ago

I'll never fly 737 Max. No matter what changes they do, barring a complete redesign of the plane. Boeing deserves to go out of business for this.

chasingthewind 8y ago
I'm not going to defend Boeing's conduct here for one moment, but I do think your statement is an over-reaction. The company employs 150,000 people, it contributes billions to the US economy, and builds significant aerospace know-how in the US. I imagine we could come up with lots of reasons why Boeing is a net positive. These crashes are tragic and Boeing's conduct deserves condemnation, but a solution that keeps the company going and fixes the culture that led to this seems to be a far better solution than them going out of business entirely.
- fopen64 8y ago
  If I pack air, sell it as panacea, and employ 150k people doing that, do I deserve to be be in business?
  - salex89 8y ago
    If you can actually pay 150k people, maybe you do, since you're bloody good at it! Joke aside, let's be fair, Boeing did not sell air. Their greed got the better of them, and the institutions set to prevent that did not do their job. They should take responsibility for the things they did (or in this case, did not). There is no penalty high enough to bring back lives.
    - rubinelli 8y ago
      I wish there was a law to nationalize a company that was found guilty of gross negligence, to subsequently pay damages and re-sell them in the market. Make shareholders accountable, instead of sending a couple of middle managers to jail and keeping the same incentives that caused the first tragedy in place.

linuxftw 8y ago

Still doesn't answer the question of, why if MCAS is required during critical portions of the flight to prevent stalling is disabling of MCAS an acceptable solution for this aircraft? Introducing a new condition of "We think MCAS is on, but we're not quite sure / it's cutting in and out due to censor disagreements" is preposterous.

ams6110 8y ago
This might be splitting hairs, but MCAS is not there to prevent stalling. It's there to meet a specific certification requirement on control stick forces at high angles of attack. Yes the intent of the requirement is to reduce the tendency of the pilot to pitch up too much near the stall. But MCAS doesn't prevent stalling. Modern aircraft have many automatic systems that are there to make the pilot's job easier. That doesn't mean they are unsafe to fly if those systems malfunction and have to be disabled.
- linuxftw 8y ago
  Every source I've found refers to it as an anti stall system, and the system is designed to limit angle of attack (eg, prevent the system from stalling). It's definitely a safety feature that's required and not an assistive device. It was required for certification, and in fact as originally specified was unsuitable to prevent stalls, so Boeing had to increase the authority of the system to make it functional.

tomnm 8y ago

Physics cannot be fixed by software. The necessity of MCAS means the airframe has fatal flaws. I would avoid 737 Max by all means, no matter whatever software revisions Boeing releases. Previous discussions: https://news.ycombinator.com/item?id=19509618 https://news.ycombinator.com/item?id=19509618

wp381640 8y ago
most modern fighter jets would drop out of the sky like a rock without software they'll eventually get this right - they just need to step back and recognise that the MAX is a completely new type of aircraft and stop taking shortcuts on certification and training what saves them is that Airbus is at production capacity on the neo
- yardie 8y ago
  I wouldn't hold fighter jets up as an example of safety. They spend more time broken then they do operational. Require a an entire team of engineers for each airframe, and the number of pilot deaths/flight time is pretty atrocious. But since it's 1-2 pilot deaths rather than >100 passengers we put up with it. A well designed aircraft should not have a single point of failure, including the software.
- bobowzki 8y ago
  While it's true that fighter jets have been aerodynamically unstable for decades, they're not built for transportation and have ejection seats. The main reason they are unstable is to increase agility. Is this necessary or even wanted in passenger aviation? I don't know but I'd guess not. Probably safety, comfort and fuel economy are far more important and can (should?) be achieved with a stable airframe.
  - wp381640 8y ago
    fighter jets are the more extreme and established example, it also applies to most modern airliners which have software systems in place to prevent human controls from exceeding the aircraft flight envelope fuel efficiency in these modern aircraft has been gained with swept back wings, larger intake engines etc. which with direct control and no software would be almost impossible to keep flying discarding all of these systems because of a problem with one would set airline safety and efficiency back decades

just_steve_h 8y ago

Here's the design decision that puzzles me the most: MCAS commands nose-down trim. The pilot uses the trim button on the yoke to command nose-up trim. Why isn't that enough to disable MCAS and cause an audible alert? Think of an analogy: when the autopilot commands a nose-down elevator input, and the pilot pulls back on the control column, that's enough to disengage the autopilot. Or think of cruise control in a car: if the computer commands acceleration, and the driver steps on the brake, cruise control disengages. The necessity of MCAS is to meet regulatory requirements for similarity in handling characteristics to achieve a common type rating. It's not strictly an engineering requirement, nor is it a safety-assisting technology. It's an attempt to mask the actual aerodynamic characteristics of the aircraft being flown. That is a conflicting mission if you will.

wp381640 8y ago
> Why isn't that enough to disable MCAS From what I understand it did but it would reengage again. It's the reason why the Lion Air flight lasted longer in the air than Ethiopian, because the pilots in that case kept hitting the trim and buying themselves 40-60 seconds each time
- oflannabhra 8y ago
  Yep, and on top of that the 737 MAX did not require retraining for pilots (cost savings for Boeing and airlines) and Boeing did not provide documentation to pilots that MCAS would re-engage after a short timeout. Pilots use the term "ahead of the plane" to describe being in a state where they understand exactly how a plane and its systems will respond to inputs (including theirs). MCAS (and lack of training) resulted in pilots being "behind the plane", which meant they could not regain control over the plane and ultimately crashed.
- briandear 8y ago
  They could have disabled the whole thing if they simply followed the standard runaway trim procedure. A system malfunction should appear to a pilot the same way a runaway trim wheel appears. The result is that there is runaway trim checklist—and a procedure to work around it. You turn off the electric trim and go to a manual reversion. It’s something every 737 pilot trains for. Here’s some discussion about this from 2009: https://www.airliners.net/forum/viewtopic.php?t=761011 https://www.airliners.net/forum/viewtopic.php?t=761011 Even if the cause is an MCAS failure, the way that failure presents in the cockpit follows the same procedures as runaway trim: which means to me that the Ethiopian and Lion Air pilots were simply under-trained. The 200 total hours of the Ethiopian first officer supports that assertion. In the US, a first officer has a 1500 hour requirement: having a 200 hour pilot in the cockpit can’t be ignored as a contributing cause especially since following the standard checklists would have saved the plane— if the first officer would have known to consult those checklists. In the US, you can’t even fly Cessnas commercially with 200 hours and this first officer was copiloting a modern 737.

bdavis__ 8y ago

The amount of Boeing hate is phenomenal. "scrap the plane" ! "require a new type certificate" "never fly in a 737 max, no matter what". Boeing made a plane that conformed to all rules and regulations. As part of the design process, they made many, many tradeoff's. What kind of fastener goes on this panel? How often does this data go across the data bus? What material is used for this cable? Literally thousands of them. Not every one , by itself is safety critical; but many of them can turn out to be. The MCAS design was not some engineer skirting the law, or wanting to kill people, or even disinterested in safety. It was a compromise design of cost vs safety; in hindsight it looks like the compromise was done poorly. A 100% safe airplane weighs too much to fly and costs too much to build. This means every design decision has to take into account other things than just 'raw safety'. They made a mistake. Even when you are not "moving fast and breaking things", people make mistakes. process adherence misses the mistake. And in this case people die. Unfortunately, that is how we improve aviation safety. With the blood of passengers and crew. Not on purpose, not because boeing is greedy, but because people make mistakes, systems fail, airplanes crash. This was not a single failure of the aviation safety system. N things had to happen for these crashes. And the system is going to fix each one of them, and do a humans best effort to change the process so it does not happen again. i would fly a Boeing aircraft tomorrow (yes, a 737 MAX 8). Or an Airbus. They are both built and overseen by the best our world has to offer. This is not the first design failure that has been the cause of an incident (or even a series of incidents) and it will not be the last.