4 ms·

I strongly suggest people skip this re-hosted article, and instead read the Reuters one here: Title: Boeing software under scrutiny as Ethiopia prepares crash

I strongly suggest people skip this re-hosted article, and instead read the Reuters one here: Title: Boeing software under scrutiny as Ethiopia prepares crash report https://www.reuters.com/article/us-ethiopia-airplane-software/exclusive-boeing-software-engaged-repeatedly-before-crash-sources-idUSKCN1RF0YU https://www.reuters.com/article/us-ethiopia-airplane-softwar... I have numerous problems with Arstechnica's re-write, but suffice to say that nuance is lost and questionable conclusory statements added. I will say in the case of BOTH articles, it sounds like we need to wait and see. Neither article has an answer for how auto-trim was re-actived, be it the pilots or something else. The answer to that question may have wide reaching implications.

sctb 8y ago
Thanks! We've updated the link from https://arstechnica.com/information-technology/2019/04/ethiopian-air-pilots-turned-off-737-max-anti-stall-system-then-it-turned-on-again/ https://arstechnica.com/information-technology/2019/04/ethio....
digikata 8y ago
This other HN submission has some interesting hypotheticals on why the system might have been reactivated multiple times: https://news.ycombinator.com/item?id=19565056 https://news.ycombinator.com/item?id=19565056
- acqq 8y ago
  This analysis sounds very plausible (all emphasis marks mine): https://leehamnews.com/2019/04/03/et302-used-the-cut-out-switches-to-stop-mcas/ https://leehamnews.com/2019/04/03/et302-used-the-cut-out-swi... "the high speeds observed in ET302’s FlightRadar24 trace (Figure 1) were logical. It’s a consequence of following the Emergency checklist for “IAS disagree” (IAS is Indicated Airspeed, i.e. the dynamic air pressure experienced by the aircraft) after takeoff. The combination of the preceding checklist followed by an MCAS Trim Runaway checklist could create a situation where manual trimming after a Trim Cut-Out would be difficult to impossible and would require non-checklist actions." "At a miss-trimmed Stabilator, you either have to re-engage Electric trim or off-load the Stabilator jackscrew by stick forward, creating a nose-down bunt maneuver, followed by trim. Stick forward to trim was not an option for ET302, they were at 1,000ft above ground. According to The Wall Street Journal, the ET302 crew re-engaged electrical trim to save the situation, to get the nose up. It was their only chance. But too late. The aggressive MCAS kicked in and worsened the situation before they could counter it." The Airport elevation of Addis Ababa airport is 7625 feet AMSL. The highest point of the flight recorded by the flightradar24 is 8600 ft AMSL which gives the plane's altitude of around only 1000 ft at highest! The speeds relative to the ground recorded near the end were 380 kt, i.e. 640 ft/s. Obviously every second mattered, and at the above speeds, the plane was only a few seconds from crash away when the MCAS was pointing the nose down.
  - js2 8y ago
    Weird, I guessed at something like that in a related article submitted earlier: https://news.ycombinator.com/item?id=19560596 https://news.ycombinator.com/item?id=19560596
    - cjbprime 8y ago
      Not quite the same -- the issue wouldn't be that they didn't crank enough, but that cranking was physically impossible due to the aerodynamic load on the stabilizer created by being at high speed with the elevator and stabilizer airflow opposing each other. You'd have to release the elevator in order to regain control of the stabilizer, and you can't do that without losing altitude that you don't have to give.
  - cjbprime 8y ago
    I remember reading precisely this scenario theorized here on HN a few weeks ago: https://news.ycombinator.com/item?id=19383756 https://news.ycombinator.com/item?id=19383756
  - inferiorhuman 8y ago
    Leeham worked with MentourPilot, a training captain for Ryanair, on this article. There was a video included, but it's since been taken down. If you've seen any of Mentour's videos they are fantastic and he is typically quite good about remaining objective and avoiding wild speculation.
  - Gibbon1 8y ago
    > The combination of the preceding checklist followed by an MCAS Trim Runaway checklist could create a situation where manual trimming after a Trim Cut-Out would be difficult to impossible and would require non-checklist actions." This is a talk by Professor Nancy Leveson that describes exactly this type of problem. Dangerous interactions between systems. I posted this before when a lot of people were engaging in low grade racism by blaming the Indonesian and Ethiopian pilots competence and training. Seems very topical at this point tho. https://www.youtube.com/watch?v=WBktiCyPLo4 https://www.youtube.com/watch?v=WBktiCyPLo4
acqq 8y ago
> Neither article has an answer for how auto-trim was re-actived, be it the pilots or something else. The answer to that question may have wide reaching implications. I can imagine that being irrelevant in this case: Even if the pilots activated it, it doesn't mean they must have made any error, see my other comment here for the details. In short, if the pilots turned the switch off, turning off much more than just the MCAS (as there's no switch "just turn MCAS off, keep the rest on"), but then the plane was already not possible to save (it was only 1000 ft above the ground!) and they turned the switch back on, hoping for obtaining more power/possibility to trim, and the faulty MCAS kicked in again (despite being the reason for the switch cutoff before) and even sped up the crash, then the pilots in fact did absolutely all that was possible to do. And I can even imagine that the code which included the promised "fix" by Boeing until just a few days ago still had the built-in "obvious to implement by default" logic: "oh, I'm booting, now I can point the plane to the ground again because the sensors say so and I'm completely ignoring the fact that the pilots already turned me off shortly before" and that that was the reason the fix release is now delayed. But also note that that plane, the way it is constructed, certified and sold simply needs the MCAS and can't reliably fly without it, otherwise Boeing's fix would have been turning the feature off completely.
- SolaceQuantum 8y ago
  "...if the pilots turned the switch off, turning off much more than just the MCAS (as there's no switch "just turn MCAS off, keep the rest on"), but then the plane was already not possible to save (it was only 1000 ft above the ground!) and they turned the switch back on, hoping for obtaining more power/possibility to trim, and the faulty MCAS kicked in again (despite being the reason for the switch cutoff before) and even sped up the crash, then the pilots in fact did absolutely all that was possible to do..." If this is indeed what is announced, I sincerely hope the responsible parties for making the decision to go through with MCAS in this way are paid well in jail time.
  - KMag 8y ago
    > If this is indeed what is announced, I sincerely hope the responsible parties for making the decision to go through with MCAS in this way are paid well in jail time. I'm sorry, but your wording sounds like you're advocating taking revenge on engineers / managers for poor decisions made in good faith. That's barbaric, and I hope we as a society move beyond this sort of communal revenge. We'll all be psychologically better off if we encourage more healthy ways of seeking relief from tragedy.

sctb 8y ago

Thanks! We've updated the link from https://arstechnica.com/information-technology/2019/04/ethiopian-air-pilots-turned-off-737-max-anti-stall-system-then-it-turned-on-again/ https://arstechnica.com/information-technology/2019/04/ethio....

digikata 8y ago

This other HN submission has some interesting hypotheticals on why the system might have been reactivated multiple times: https://news.ycombinator.com/item?id=19565056 https://news.ycombinator.com/item?id=19565056

acqq 8y ago
This analysis sounds very plausible (all emphasis marks mine): https://leehamnews.com/2019/04/03/et302-used-the-cut-out-switches-to-stop-mcas/ https://leehamnews.com/2019/04/03/et302-used-the-cut-out-swi... "the high speeds observed in ET302’s FlightRadar24 trace (Figure 1) were logical. It’s a consequence of following the Emergency checklist for “IAS disagree” (IAS is Indicated Airspeed, i.e. the dynamic air pressure experienced by the aircraft) after takeoff. The combination of the preceding checklist followed by an MCAS Trim Runaway checklist could create a situation where manual trimming after a Trim Cut-Out would be difficult to impossible and would require non-checklist actions." "At a miss-trimmed Stabilator, you either have to re-engage Electric trim or off-load the Stabilator jackscrew by stick forward, creating a nose-down bunt maneuver, followed by trim. Stick forward to trim was not an option for ET302, they were at 1,000ft above ground. According to The Wall Street Journal, the ET302 crew re-engaged electrical trim to save the situation, to get the nose up. It was their only chance. But too late. The aggressive MCAS kicked in and worsened the situation before they could counter it." The Airport elevation of Addis Ababa airport is 7625 feet AMSL. The highest point of the flight recorded by the flightradar24 is 8600 ft AMSL which gives the plane's altitude of around only 1000 ft at highest! The speeds relative to the ground recorded near the end were 380 kt, i.e. 640 ft/s. Obviously every second mattered, and at the above speeds, the plane was only a few seconds from crash away when the MCAS was pointing the nose down.
- js2 8y ago
  Weird, I guessed at something like that in a related article submitted earlier: https://news.ycombinator.com/item?id=19560596 https://news.ycombinator.com/item?id=19560596
  - cjbprime 8y ago
    Not quite the same -- the issue wouldn't be that they didn't crank enough, but that cranking was physically impossible due to the aerodynamic load on the stabilizer created by being at high speed with the elevator and stabilizer airflow opposing each other. You'd have to release the elevator in order to regain control of the stabilizer, and you can't do that without losing altitude that you don't have to give.
- cjbprime 8y ago
  I remember reading precisely this scenario theorized here on HN a few weeks ago: https://news.ycombinator.com/item?id=19383756 https://news.ycombinator.com/item?id=19383756
- inferiorhuman 8y ago
  Leeham worked with MentourPilot, a training captain for Ryanair, on this article. There was a video included, but it's since been taken down. If you've seen any of Mentour's videos they are fantastic and he is typically quite good about remaining objective and avoiding wild speculation.
- Gibbon1 8y ago
  > The combination of the preceding checklist followed by an MCAS Trim Runaway checklist could create a situation where manual trimming after a Trim Cut-Out would be difficult to impossible and would require non-checklist actions." This is a talk by Professor Nancy Leveson that describes exactly this type of problem. Dangerous interactions between systems. I posted this before when a lot of people were engaging in low grade racism by blaming the Indonesian and Ethiopian pilots competence and training. Seems very topical at this point tho. https://www.youtube.com/watch?v=WBktiCyPLo4 https://www.youtube.com/watch?v=WBktiCyPLo4

acqq 8y ago

> Neither article has an answer for how auto-trim was re-actived, be it the pilots or something else. The answer to that question may have wide reaching implications. I can imagine that being irrelevant in this case: Even if the pilots activated it, it doesn't mean they must have made any error, see my other comment here for the details. In short, if the pilots turned the switch off, turning off much more than just the MCAS (as there's no switch "just turn MCAS off, keep the rest on"), but then the plane was already not possible to save (it was only 1000 ft above the ground!) and they turned the switch back on, hoping for obtaining more power/possibility to trim, and the faulty MCAS kicked in again (despite being the reason for the switch cutoff before) and even sped up the crash, then the pilots in fact did absolutely all that was possible to do. And I can even imagine that the code which included the promised "fix" by Boeing until just a few days ago still had the built-in "obvious to implement by default" logic: "oh, I'm booting, now I can point the plane to the ground again because the sensors say so and I'm completely ignoring the fact that the pilots already turned me off shortly before" and that that was the reason the fix release is now delayed. But also note that that plane, the way it is constructed, certified and sold simply needs the MCAS and can't reliably fly without it, otherwise Boeing's fix would have been turning the feature off completely.

SolaceQuantum 8y ago
"...if the pilots turned the switch off, turning off much more than just the MCAS (as there's no switch "just turn MCAS off, keep the rest on"), but then the plane was already not possible to save (it was only 1000 ft above the ground!) and they turned the switch back on, hoping for obtaining more power/possibility to trim, and the faulty MCAS kicked in again (despite being the reason for the switch cutoff before) and even sped up the crash, then the pilots in fact did absolutely all that was possible to do..." If this is indeed what is announced, I sincerely hope the responsible parties for making the decision to go through with MCAS in this way are paid well in jail time.
- KMag 8y ago
  > If this is indeed what is announced, I sincerely hope the responsible parties for making the decision to go through with MCAS in this way are paid well in jail time. I'm sorry, but your wording sounds like you're advocating taking revenge on engineers / managers for poor decisions made in good faith. That's barbaric, and I hope we as a society move beyond this sort of communal revenge. We'll all be psychologically better off if we encourage more healthy ways of seeking relief from tragedy.