4 ms·

Specifically it's the argument in the article that large disasters often have multiple causes. "Perrow says, Murphy's Law is wrong—what can go wrong usually goe

Specifically it's the argument in the article that large disasters often have multiple causes. "Perrow says, Murphy's Law is wrong—what can go wrong usually goes right. But then one day a few of the bad little choices come together, and circumstances take an airplane down. Who, then, is really to blame?" But that's exactly what's disingenuous about the GP's claim. Many disasters do indeed involve a sequence of mistakes of different sorts but that's not really the case here. The situation with 737 max was one terribly system and the pilot's complete inability to stop this - inability that could have been anticipated and which was the product of the original bad design. "His point is that these accidents are science's illegitimate children, bastards born of the confusion that lies within the complex organizations with which we manage our dangerous technologies." This kind of disaster certainly can happen but the situation with the 737 Max was Boeing pushing an old design far beyond it's limits because of the threat of losing market share and regulators allowing this.

mlyle 7y ago
> The situation with 737 max was one terribly system and the pilot's complete inability to stop this - inability that could have been anticipated and which was the product of the original bad design. You accuse me of being disingenuous and immediately follow it with a false claim. This is untrue. Stabilator trim can be turned off. Indeed, before Lion Air 610 the previous flight had experienced the problem and had dealt with it correctly. Also, re-trimming using the trim switch disables MCAS for some number of seconds. In the case of ET302, they turned the system off, but allowed the aircraft to overspeed and were, as a result, unable to retrim manually. Still, they had a positive rate of climb. It is only when they turned it back on in violation of training/checklist and inexplicably did not use it to retrim nose up that they were doomed. > This kind of disaster certainly can happen but the situation with the 737 Max was Boeing pushing an old design far beyond it's limits because of the threat of losing market share and regulators allowing this. I strongly disagree. I think it's a badly engineered system but things like this are part of the normal design refinement that happens when planes are stretched and iterated upon. The 737 has bad handling on pitch during departure; bigger, more powerful 737's have it worse, and it makes sense to fix this.
- joe_the_user 7y ago
  I believe my position is that of the strong consensus of the long debates that have gone on in detail here and in numerous mainstream and technical publications. I can't summarize all the arguments there and I won't try but the conclusion has been Boeing is to blame (period). In this day and age, I'm suspicious and annoyed even small effort to improperly spread blame when that spreading serves powerful interests.
  - mlyle 7y ago
    Basically all of aviation safety is about the spreading of blame and plugging up holes. Either approach is wrong: just pointing to the pilot and saying "hah-hah error" without considering what led to the error is what aviation did for decades. "Crash less!" we said to pilots, and were surprised when things didn't improve much. But you can't ignore crew performance, either. The crews that crashed did not do great. But if a system is regularly putting crews to the test in a way that requires high levels of personal performance to survive, that's a bigger problem. And MCAS is more easily improved than the rest: we can more easily reduce the frequency and severity of that "testing" than we can improve all flight crews. But we shouldn't ignore the problems in crew decision-making, and the related training choices (e.g. not requiring crews to demonstrate handling of runaway trim in some jurisdictions).
    - salawat 7y ago
      >The crews that crashed did not do great. Not necessarily fair since one didn't even know what they were up against, and the other was trusting a Boeing checklist that wasn't guaranteed to work, and only stood a realistic chance at working if the failure did not occur at a critical stage of the flight, where a currently undocumented maneuver could be performed. (The 'roller coaster' by which the pilot allows the plane to dive to unload the stabilizer so it can be trimmed) >And MCAS is more easily improved than the rest: we can more easily reduce the frequency and severity of that "testing" than we can improve all flight crews. But we shouldn't ignore the problems in crew decision-making, and the related training choices (e.g. not requiring crews to demonstrate handling of runaway trim in some jurisdictions). This is just poppycock, if you ask me. MCAS was a desperate attempt to satisfy a prescriptive behavior requirement (FAR 25.173, demonstration of longitudinal stability) during which the plane should not experience slackening control forces all the way to the stall in a wind up turn, which non-compliance with would disqualify the airframe from certification under the grandfathered 737 type certificate and as a Civil Transport Airplane. There would have been no need to consider the skill of the pilots if due diligence and proper redundancy concomitant to the actual hazards of the design had been done, which weren't due to management's pressure to get this damn plane flying on time at any cost.
jdietrich 7y ago
>But that's exactly what's disingenuous about the GP's claim. Many disasters do indeed involve a sequence of mistakes of different sorts but that's not really the case here. The situation with 737 max was one terribly system and the pilot's complete inability to stop this - inability that could have been anticipated and which was the product of the original bad design. MCAS is a badly designed system, but many other stabiliser control failures could cause the aircraft to rapidly lose altitude. The solution is the same in all cases - flip the cutoff switches to disconnect automatic stab control and trim the stabiliser manually using the wheel on the center console. The flight crews in both MCAS-related disasters showed serious failures in airmanship and a lack of understanding of the fundamentals of flight. They were taken by surprise by MCAS, but they should have been more than capable of swiftly handling that situation; their inability to do so is symptomatic of broader failings in the training and culture of pilots in many emerging markets. https://www.nytimes.com/interactive/2018/11/16/world/asia/lion-air-crash-cockpit.html https://www.nytimes.com/interactive/2018/11/16/world/asia/li... https://www.nytimes.com/2019/09/18/magazine/boeing-737-max-crashes.html https://www.nytimes.com/2019/09/18/magazine/boeing-737-max-c...
- mlyle 7y ago
  > MCAS is a badly designed system, but many other stabiliser control failures could cause the aircraft to rapidly lose altitude. The solution is the same in all cases - flip the cutoff switches to disconnect automatic stab control and trim the stabiliser manually using the wheel on the center console. ET302 tried this-- maybe slightly late, but MCAS is weird/sneaky. Still, it's hard to fault their response at this point. They were unable to budge the trim wheel because of overspeed. They were barely climbing at Vmo. This left them in a difficult position. Ideal response would be to reduce power (prevent overspeed), keep climbing at Vmo. During this, try to turn trim wheel. If necessary, once they had sufficient altitude, they could aerodynamically unload and trim. Instead they, for some reason, decided to turn the stabilator trim system back on (whoops 1), and then used it an insufficient amount to get trim to a reasonable place (whoops 2), and then left it on for MCAS to trigger again (whoops 3).

mlyle 7y ago

> The situation with 737 max was one terribly system and the pilot's complete inability to stop this - inability that could have been anticipated and which was the product of the original bad design. You accuse me of being disingenuous and immediately follow it with a false claim. This is untrue. Stabilator trim can be turned off. Indeed, before Lion Air 610 the previous flight had experienced the problem and had dealt with it correctly. Also, re-trimming using the trim switch disables MCAS for some number of seconds. In the case of ET302, they turned the system off, but allowed the aircraft to overspeed and were, as a result, unable to retrim manually. Still, they had a positive rate of climb. It is only when they turned it back on in violation of training/checklist and inexplicably did not use it to retrim nose up that they were doomed. > This kind of disaster certainly can happen but the situation with the 737 Max was Boeing pushing an old design far beyond it's limits because of the threat of losing market share and regulators allowing this. I strongly disagree. I think it's a badly engineered system but things like this are part of the normal design refinement that happens when planes are stretched and iterated upon. The 737 has bad handling on pitch during departure; bigger, more powerful 737's have it worse, and it makes sense to fix this.

joe_the_user 7y ago
I believe my position is that of the strong consensus of the long debates that have gone on in detail here and in numerous mainstream and technical publications. I can't summarize all the arguments there and I won't try but the conclusion has been Boeing is to blame (period). In this day and age, I'm suspicious and annoyed even small effort to improperly spread blame when that spreading serves powerful interests.
- mlyle 7y ago
  Basically all of aviation safety is about the spreading of blame and plugging up holes. Either approach is wrong: just pointing to the pilot and saying "hah-hah error" without considering what led to the error is what aviation did for decades. "Crash less!" we said to pilots, and were surprised when things didn't improve much. But you can't ignore crew performance, either. The crews that crashed did not do great. But if a system is regularly putting crews to the test in a way that requires high levels of personal performance to survive, that's a bigger problem. And MCAS is more easily improved than the rest: we can more easily reduce the frequency and severity of that "testing" than we can improve all flight crews. But we shouldn't ignore the problems in crew decision-making, and the related training choices (e.g. not requiring crews to demonstrate handling of runaway trim in some jurisdictions).
  - salawat 7y ago
    >The crews that crashed did not do great. Not necessarily fair since one didn't even know what they were up against, and the other was trusting a Boeing checklist that wasn't guaranteed to work, and only stood a realistic chance at working if the failure did not occur at a critical stage of the flight, where a currently undocumented maneuver could be performed. (The 'roller coaster' by which the pilot allows the plane to dive to unload the stabilizer so it can be trimmed) >And MCAS is more easily improved than the rest: we can more easily reduce the frequency and severity of that "testing" than we can improve all flight crews. But we shouldn't ignore the problems in crew decision-making, and the related training choices (e.g. not requiring crews to demonstrate handling of runaway trim in some jurisdictions). This is just poppycock, if you ask me. MCAS was a desperate attempt to satisfy a prescriptive behavior requirement (FAR 25.173, demonstration of longitudinal stability) during which the plane should not experience slackening control forces all the way to the stall in a wind up turn, which non-compliance with would disqualify the airframe from certification under the grandfathered 737 type certificate and as a Civil Transport Airplane. There would have been no need to consider the skill of the pilots if due diligence and proper redundancy concomitant to the actual hazards of the design had been done, which weren't due to management's pressure to get this damn plane flying on time at any cost.

jdietrich 7y ago

>But that's exactly what's disingenuous about the GP's claim. Many disasters do indeed involve a sequence of mistakes of different sorts but that's not really the case here. The situation with 737 max was one terribly system and the pilot's complete inability to stop this - inability that could have been anticipated and which was the product of the original bad design. MCAS is a badly designed system, but many other stabiliser control failures could cause the aircraft to rapidly lose altitude. The solution is the same in all cases - flip the cutoff switches to disconnect automatic stab control and trim the stabiliser manually using the wheel on the center console. The flight crews in both MCAS-related disasters showed serious failures in airmanship and a lack of understanding of the fundamentals of flight. They were taken by surprise by MCAS, but they should have been more than capable of swiftly handling that situation; their inability to do so is symptomatic of broader failings in the training and culture of pilots in many emerging markets. https://www.nytimes.com/interactive/2018/11/16/world/asia/lion-air-crash-cockpit.html https://www.nytimes.com/interactive/2018/11/16/world/asia/li... https://www.nytimes.com/2019/09/18/magazine/boeing-737-max-crashes.html https://www.nytimes.com/2019/09/18/magazine/boeing-737-max-c...

mlyle 7y ago
> MCAS is a badly designed system, but many other stabiliser control failures could cause the aircraft to rapidly lose altitude. The solution is the same in all cases - flip the cutoff switches to disconnect automatic stab control and trim the stabiliser manually using the wheel on the center console. ET302 tried this-- maybe slightly late, but MCAS is weird/sneaky. Still, it's hard to fault their response at this point. They were unable to budge the trim wheel because of overspeed. They were barely climbing at Vmo. This left them in a difficult position. Ideal response would be to reduce power (prevent overspeed), keep climbing at Vmo. During this, try to turn trim wheel. If necessary, once they had sufficient altitude, they could aerodynamically unload and trim. Instead they, for some reason, decided to turn the stabilator trim system back on (whoops 1), and then used it an insufficient amount to get trim to a reasonable place (whoops 2), and then left it on for MCAS to trigger again (whoops 3).