6 ms·

s/This accident/These accidents/ As you'll find in this article below, Boeing specifically removed the yoke-back function, which is the natural pilot input to

s/This accident/These accidents/ As you'll find in this article below, Boeing specifically removed the yoke-back function, which is the natural pilot input to nose up the plane. They also specifically for the MAX removed the separate switch for automatic stab trim assistance, so you have to turn off the motorized function entirely to turn off automated inputs including MCAS. The Lion Air crew could be heard on the radio saying that they did disable the stab trim, but in this situation the force required on the manual trim wheel was beyond the pilots' strength. The pilots turned the electronic stab trim back on in hopes of using the powered system to get back up, after which the undocumented and unstoppable MCAS nosed down the plane again, killing them and their passengers. https://www.seattletimes.com/business/boeing-aerospace/boeings-emergency-procedure-for-737-max-may-have-failed-on-ethiopian-flight/?amp=1 https://www.seattletimes.com/business/boeing-aerospace/boein... Your post reads like a sophisticated attempt to blame the victims, or at least the pilots and ground crews of the victims. These crashes were not caused by poor pilots, but rather secrets on top of secrets, all by Boeing, all for money. The MAX had new aerodynamic characteristics, but that needed to be a secret. So MCAS was added to the electronic trim assistance to hide the new characteristics, and the switch to disable it was removed to protect the secret. A faulty AOA sensor was now able to bring down the plane, but in order to keep the secret the single AOA option was still available and sold. Maintenance crews regardless of quality would not have been aware of the criticality of the AOA's secret role as a single point of failure for the whole plane. When the first one crashed, secrets covered it up. When the second one crashed, it still took all of those "ppor maintenance", "broad quality" non-US airlines and regulators to bring a stop to it. And apparently the secret-keepers are still trying to hide. Please don't blame dead pilots for this.

salawat 7y ago
One more thing, the flight computer was eventually found to be a single point of failure after being subjected to testing that should have been done in the first place. https://www.seattletimes.com/business/boeing-aerospace/newly-stringent-faa-tests-spur-a-fundamental-software-redesign-of-737-max-flight-controls/ https://www.seattletimes.com/business/boeing-aerospace/newly... Another regulatory no-no that wasn't brought up until the certified aircraft had been out in the wild long enough to kill people.
- privateSFacct 7y ago
  Is this the five independent bit flips in worst possible order and combination from cosmic rays failure? First -> if this is your worst failure mode (ie, worse than pilot error, mechanical fatigue and failure, engine failures, fueling issues, crazy passengers etc) then you have a plane and overall safety system that is incredible. Second -> this wild set of events again does not crash the plane - though it would put the pilots in a bad spot similar to the existing MCAS issues.
  - salawat 7y ago
    >First -> if this is your worst failure mode (ie, worse than pilot error, mechanical fatigue and failure, engine failures, fueling issues, crazy passengers etc) then you have a plane and overall safety system that is incredible. Or would be, if it didn't violate design constraints that demand no single point of failure can have the capability to result in loss of the aircraft. I.e. components with failure profiles of catastrophic severity MUST have redundancy. You test the least likely events to ensure you have sufficient fault tolerance for that very reason. >Second -> this wild set of events again does not crash the plane - though it would put the pilots in a bad spot similar to the existing MCAS issues. Actually, one of the three test pilots did in fact lose the plane in the simulator. Hence the reclassification of the flight computer as a component with a catastrophic failure potential. Look, I'm about the last person you're going to get to buy into the awesome safety of an aircraft that can't even pass a textbook test case for computing in adverse environments. If the bloody thing was so safe and high quality, it wouldn't have been able to suffer that induced failure in the first place. It would have been designed out. The fact Boeing was caught off guard by that failure means they weren't looking very hard, and were banking that no one else would either. Which is generally a really bad assumption to make, because Murphy finds a way. Every time.
    - privateSFacct 7y ago
      There's lots of potential for failure that the planes allow when flying. Some quick examples - they could have sensors around gas quality but do not - they rely on the folks providing the avgas to have good fuel. They could do built in weight and balance calcs with sensors - they do not, they rely on poor estimates for that. etc. Boeing in particular ALLOWS pilots to fly planes outside of most flight envelope limits. They do this in part because historically they didn't trust the computer as much and trusted pilots more. Airbus by contrast doesn't let you do this unless you take air data totally offline or something crazy to force alternative law. I suspect boeing will be moving towards the airbus model which is probably right. Airbus had arguably less local myopia when designing their planes - ie, future pilot populations come from a big group and making the plane as error proof as possible is best. Airbus had some issues around their automation without pilot override initially but I think those are resolved by now. If you want a scary video - check out this early A320 flying - first fly by wire / autothrottle: https://www.youtube.com/watch?v=YAg-WauGrLU https://www.youtube.com/watch?v=YAg-WauGrLU Can't have been a good feeling as that pilot. Note that the A320 is now considered a very safe plane. Aircraft have evolved from systems with almost no built in redundancy or safety. The design of the 737 is pretty old - 1967 or so. Let that sink in for a bit, consider what type of tech they had back in. This is not a 777 generation plane or even A320.
privateSFacct 7y ago
Stab trim cutout has been the response item for a long time. Before the stab trim was turned on again the plane was climbing. "unstoppable MCAS" * Leave stab trim cut * Hold electric trim up * Control airspeed * etc... AoA senor is not a single point of failure. The 737 is not a fully automatic / flight protected plane. ie, the plane will continue flying with very little sensor input at all - you can even dispatch with problems with a surprising amount of equipment under the MEL.
- largbae 7y ago
  Thank goodness it's so safe! I am glad we are only talking about theoretical crazy combinations of events that can lead to a crash... You brought up faulty replacement parts yourself as a contributing cause, but when challenged you switch to methods to stop the unstoppable, undocumented MCAS. To which faulty part were you referring? The unimportant, non-SPOF AOA sensor?
  - privateSFacct 7y ago
    The cosmic ray bit-flip of the 5 independent critical bits is very unlikely. We are being told right here on HN and in the news that this means the plane can't fly. In the US there were close calls, but fewer. If you beleive in the chain of safety better maintenance and pilot response may have saved the day a few times when faced with the MCAS problems. The safety reports from US pilots certainly sound scary (nose down on takeoff GPWS alerts etc). I brought up maintenance as a contributing cause in the 737MAX crashes. I didn't realize I had been challenged on this. I would really encourage you to read some of the source reporting. The FAA had a safety notice on this precise topic "FAA has determined it is necessary to advise operators of the importance of performing proper operations and maintenance on AOA sensors” This is the detail on the previous lionair flight before the crash flight - from wikipedia to save time: "it had problems maintaining a constant altitude, with passengers stating that it was like "a roller-coaster ride".[109] The chief executive officer of Lion Air, Edward Sirait, said the aircraft had a "technical issue" on Sunday night, but this had been addressed in accordance with maintenance manuals issued by the manufacturer. Engineers had declared that the aircraft was ready for takeoff on the morning of the accident.[110][111] A later report claimed that a third pilot was on the flight to Jakarta and told the crew to cut power to the stabilizer trim motors which fixed the problem. This method is a standard memory item in the 737 checklist.[112] Subsequently, the National Transportation Safety Committee confirmed the presence of an off-duty Boeing 737 MAX 8 qualified pilot in the cockpit but did not confirm the role of the pilot in fixing the problem.[113] Even worse is the history before that flight - REPEATED problems with the senor. We are also now hearing that evidence submitted by lion air supposedly showing the proper fix for the sensor may have been faked. https://www.seattletimes.com/business/questions-raised-about-photos-used-as-evidence-of-repairs-in-lion-air-737-max-crash-investigation/ https://www.seattletimes.com/business/questions-raised-about... In terms of faulty replacement parts - my point was issues occur overseas that do not seem to happen within the US MROs. I'll do a quick recent example: https://www.pressreader.com/south-africa/sunday-times-1107/20191006/281526522800662 https://www.pressreader.com/south-africa/sunday-times-1107/2... This follows the ex-president of south africa appointing a school teacher to head SAA (who also ran his private foundation and rumors around their relationship existed). I'm not sure why you claim AoA is unimportant. In the chain of safety you want every advantage you can get, the more accurate data the better. So you want the AoA working. This reduces risks from MCAS. You are correct - AoA is not a single point of failure system (system is not working / plane falls from sky). There was a poster here claiming that it was.

salawat 7y ago

One more thing, the flight computer was eventually found to be a single point of failure after being subjected to testing that should have been done in the first place. https://www.seattletimes.com/business/boeing-aerospace/newly-stringent-faa-tests-spur-a-fundamental-software-redesign-of-737-max-flight-controls/ https://www.seattletimes.com/business/boeing-aerospace/newly... Another regulatory no-no that wasn't brought up until the certified aircraft had been out in the wild long enough to kill people.

privateSFacct 7y ago
Is this the five independent bit flips in worst possible order and combination from cosmic rays failure? First -> if this is your worst failure mode (ie, worse than pilot error, mechanical fatigue and failure, engine failures, fueling issues, crazy passengers etc) then you have a plane and overall safety system that is incredible. Second -> this wild set of events again does not crash the plane - though it would put the pilots in a bad spot similar to the existing MCAS issues.
- salawat 7y ago
  >First -> if this is your worst failure mode (ie, worse than pilot error, mechanical fatigue and failure, engine failures, fueling issues, crazy passengers etc) then you have a plane and overall safety system that is incredible. Or would be, if it didn't violate design constraints that demand no single point of failure can have the capability to result in loss of the aircraft. I.e. components with failure profiles of catastrophic severity MUST have redundancy. You test the least likely events to ensure you have sufficient fault tolerance for that very reason. >Second -> this wild set of events again does not crash the plane - though it would put the pilots in a bad spot similar to the existing MCAS issues. Actually, one of the three test pilots did in fact lose the plane in the simulator. Hence the reclassification of the flight computer as a component with a catastrophic failure potential. Look, I'm about the last person you're going to get to buy into the awesome safety of an aircraft that can't even pass a textbook test case for computing in adverse environments. If the bloody thing was so safe and high quality, it wouldn't have been able to suffer that induced failure in the first place. It would have been designed out. The fact Boeing was caught off guard by that failure means they weren't looking very hard, and were banking that no one else would either. Which is generally a really bad assumption to make, because Murphy finds a way. Every time.
  - privateSFacct 7y ago
    There's lots of potential for failure that the planes allow when flying. Some quick examples - they could have sensors around gas quality but do not - they rely on the folks providing the avgas to have good fuel. They could do built in weight and balance calcs with sensors - they do not, they rely on poor estimates for that. etc. Boeing in particular ALLOWS pilots to fly planes outside of most flight envelope limits. They do this in part because historically they didn't trust the computer as much and trusted pilots more. Airbus by contrast doesn't let you do this unless you take air data totally offline or something crazy to force alternative law. I suspect boeing will be moving towards the airbus model which is probably right. Airbus had arguably less local myopia when designing their planes - ie, future pilot populations come from a big group and making the plane as error proof as possible is best. Airbus had some issues around their automation without pilot override initially but I think those are resolved by now. If you want a scary video - check out this early A320 flying - first fly by wire / autothrottle: https://www.youtube.com/watch?v=YAg-WauGrLU https://www.youtube.com/watch?v=YAg-WauGrLU Can't have been a good feeling as that pilot. Note that the A320 is now considered a very safe plane. Aircraft have evolved from systems with almost no built in redundancy or safety. The design of the 737 is pretty old - 1967 or so. Let that sink in for a bit, consider what type of tech they had back in. This is not a 777 generation plane or even A320.

privateSFacct 7y ago

Stab trim cutout has been the response item for a long time. Before the stab trim was turned on again the plane was climbing. "unstoppable MCAS" * Leave stab trim cut * Hold electric trim up * Control airspeed * etc... AoA senor is not a single point of failure. The 737 is not a fully automatic / flight protected plane. ie, the plane will continue flying with very little sensor input at all - you can even dispatch with problems with a surprising amount of equipment under the MEL.

largbae 7y ago
Thank goodness it's so safe! I am glad we are only talking about theoretical crazy combinations of events that can lead to a crash... You brought up faulty replacement parts yourself as a contributing cause, but when challenged you switch to methods to stop the unstoppable, undocumented MCAS. To which faulty part were you referring? The unimportant, non-SPOF AOA sensor?
- privateSFacct 7y ago
  The cosmic ray bit-flip of the 5 independent critical bits is very unlikely. We are being told right here on HN and in the news that this means the plane can't fly. In the US there were close calls, but fewer. If you beleive in the chain of safety better maintenance and pilot response may have saved the day a few times when faced with the MCAS problems. The safety reports from US pilots certainly sound scary (nose down on takeoff GPWS alerts etc). I brought up maintenance as a contributing cause in the 737MAX crashes. I didn't realize I had been challenged on this. I would really encourage you to read some of the source reporting. The FAA had a safety notice on this precise topic "FAA has determined it is necessary to advise operators of the importance of performing proper operations and maintenance on AOA sensors” This is the detail on the previous lionair flight before the crash flight - from wikipedia to save time: "it had problems maintaining a constant altitude, with passengers stating that it was like "a roller-coaster ride".[109] The chief executive officer of Lion Air, Edward Sirait, said the aircraft had a "technical issue" on Sunday night, but this had been addressed in accordance with maintenance manuals issued by the manufacturer. Engineers had declared that the aircraft was ready for takeoff on the morning of the accident.[110][111] A later report claimed that a third pilot was on the flight to Jakarta and told the crew to cut power to the stabilizer trim motors which fixed the problem. This method is a standard memory item in the 737 checklist.[112] Subsequently, the National Transportation Safety Committee confirmed the presence of an off-duty Boeing 737 MAX 8 qualified pilot in the cockpit but did not confirm the role of the pilot in fixing the problem.[113] Even worse is the history before that flight - REPEATED problems with the senor. We are also now hearing that evidence submitted by lion air supposedly showing the proper fix for the sensor may have been faked. https://www.seattletimes.com/business/questions-raised-about-photos-used-as-evidence-of-repairs-in-lion-air-737-max-crash-investigation/ https://www.seattletimes.com/business/questions-raised-about... In terms of faulty replacement parts - my point was issues occur overseas that do not seem to happen within the US MROs. I'll do a quick recent example: https://www.pressreader.com/south-africa/sunday-times-1107/20191006/281526522800662 https://www.pressreader.com/south-africa/sunday-times-1107/2... This follows the ex-president of south africa appointing a school teacher to head SAA (who also ran his private foundation and rumors around their relationship existed). I'm not sure why you claim AoA is unimportant. In the chain of safety you want every advantage you can get, the more accurate data the better. So you want the AoA working. This reduces risks from MCAS. You are correct - AoA is not a single point of failure system (system is not working / plane falls from sky). There was a poster here claiming that it was.